Red Hat Enterprise Linux 8.0

A use-after-free flaw was found in fs/ext4/namei.c:dx_insert_block() in the Linux kernel’s filesystem sub-component. This flaw allows a local attacker with a user privilege to cause a denial of service.

Qemu-kvm: usb: assertion failure in usb_ep_get()

Kernel: information leak in nft_set_catchall_flush in net/netfilter/nf_tables_api.c

Xfig: fig2dev stack-overflow via read_objects

A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection. This flaw allows a local user to crash the system. The highest threat from this vulnerability is to system availability.

Kernel: tap: tap_open(): correctly initialize socket uid next fix of i_uid to current_fsuid

Kernel: stack overflow problem in open vswitch kernel module leading to dos

A flaw was found in s390 eBPF JIT in bpf_jit_insn in arch/s390/net/bpf_jit_comp.c in the Linux kernel. In this flaw, a local attacker with special user privilege can circumvent the verifier and may lead to a confidentiality problem.

A stack corruption bug was found in libtpms in versions before 0.7.2 and before 0.8.0 while decrypting data using RSA. This flaw could result in a SIGBUS (bad memory access) and termination of swtpm. The highest threat from this vulnerability is to system availability.

A flaw was found in NetworkManager in versions before 1.30.0. Setting match.path and activating a profile crashes NetworkManager. The highest threat from this vulnerability is to system availability.

Gimp: gimp: denial of service via crafted pvr image file

Shadow-utils: possible password leak during passwd(1) change

A vulnerability was found in libvirt. This security flaw ouccers due to repeatedly querying an SR-IOV PCI device's capabilities that exposes a memory leak caused by a failure to free the virPCIVirtualFunction array within the parent struct's g_autoptr cleanup.

Kernel: smsusb: use-after-free caused by do_submit_urb()

Libvirt: null pointer dereference in udevconnectlistallinterfaces()

Kernel: xfrm: out-of-bounds read of xfrma_mtimer_thresh nlattr

Kernel: vmxnet3: null pointer dereference in vmxnet3_rq_cleanup()

Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline.

A vulnerability was found in OpenShift Assisted Installer. During generation of the Discovery ISO, image pull secrets were leaked as plaintext in the installation logs. An authenticated user could exploit this by re-using the image pull secret to pull container images from the registry as the associated user.

A flaw was found in pesign. The pesign package provides a systemd service used to start the pesign daemon. This service unit runs a script to set ACLs for /etc/pki/pesign and /run/pesign directories to grant access privileges to users in the 'pesign' group. However, the script doesn't check for symbolic links. This could allow an attacker to gain access to privileged files and directories via a path traversal attack.

Operator: plaintext password in operator log

Xfig: transfig: fig2dev segmentation fault vulnerability

Xfig: fig2dev segmentation fault in read_arcobject

Openjpeg: denail of service via crafted image file

Gimp: signed integer overflow in file-sgi (sgi-lib) causes the plugin to crash on rle sgi images

Kernel: cxgb4: use-after-free in ch_flower_stats_cb()

A double-free memory flaw was found in the Linux kernel. The Intel GVT-g graphics driver triggers VGA card system resource overload, causing a fail in the intel_gvt_dma_map_guest_page function. This issue could allow a local user to crash the system.

Gimp: gimp: denial of service due to stack buffer overflow in tim image loader

A NULL pointer dereference flaw was found in the az6027 driver in drivers/media/usb/dev-usb/az6027.c in the Linux Kernel. The message from user space is not checked properly before transferring into the device. This flaw allows a local user to crash the system or potentially cause a denial of service.

In nf_tables_updtable, if nf_tables_table_enable returns an error, nft_trans_destroy is called to free the transaction object. nft_trans_destroy() calls list_del(), but the transaction was never placed on a list -- the list head is all zeroes, this results in a NULL pointer dereference.

Gimp: gimp file-png plugin: denial of service via oversized apng trns chunk

A flaw was found in the Framebuffer Console (fbcon) in the Linux Kernel. When providing font->width and font->height greater than 32 to fbcon_set_font, since there are no checks in place, a shift-out-of-bounds occurs leading to undefined behavior and possible denial of service.

Abrt: unsanitized systemd journal content written to dump directory files enables content injection

A NULL pointer dereference flaw was found in the UNIX protocol in net/unix/diag.c In unix_diag_get_exact in the Linux Kernel. The newly allocated skb does not have sk, leading to a NULL pointer. This flaw allows a local user to crash or potentially cause a denial of service.

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow()

Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: out-of-bounds read/write in glx changedrawableattributes

Kernel: potential deadlock on &net->sctp.addr_wq_lock leading to dos

Libarchive: a null pointer dereference vulnerability exists in the acl parser of libarchive

Operator: passwords defined in secrets shown in statefulset yaml

Kernel: deadlock leading to denial of service in tipc_crypto_key_revoke