Red Hat Enterprise Linux 9.0

A single-byte, non-arbitrary write/use-after-free flaw was found in dnsmasq. This flaw allows an attacker who sends a crafted packet processed by dnsmasq, potentially causing a denial of service.

Undertow: undertow madeyoureset http/2 ddos vulnerability

Rsync: path traversal vulnerability in rsync

Libtiff: segment fault in libtiff in tiffreadrgbatileext() leading to denial of service

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

A vulnerability found in gnutls. This security flaw happens because of a double free error occurs during verification of pkcs7 signatures in gnutls_pkcs7_verify function.

VP9 in libvpx before 1.13.1 mishandles widths, leading to a crash related to encoding.

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Libtiff: tiffrasterscanlinesize64 produce too-big size and could cause oom

Undertow: infinite loop in sslconduit during close

A vulnerability was found in libX11. The security flaw occurs because the functions in src/InitExt.c in libX11 do not check that the values provided for the Request, Event, or Error IDs are within the bounds of the arrays that those functions write to, using those IDs as array indexes. They trust that they were called with values provided by an Xserver adhering to the bounds specified in the X11 protocol, as all X servers provided by X.Org do. As the protocol only specifies a single byte for these values, an out-of-bounds value provided by a malicious server (or a malicious proxy-in-the-middle) can only overwrite other portions of the Display structure and not write outside the bounds of the Display structure itself, possibly causing the client to crash with this memory corruption.

Gnutls: incomplete fix for cve-2023-5981

Improper i/o watch removal in tls handshake can lead to remote unauthenticated denial of service

A flaw was found in the vhost library in DPDK. Function vhost_user_set_inflight_fd() does not validate `msg->payload.inflight.num_queues`, possibly causing out-of-bounds memory read/write. Any software using DPDK vhost library may crash as a result of this vulnerability.

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled

Kernel: null pointer dereference in __nvmet_req_complete

Kernel: null pointer dereference in nvmet_tcp_execute_request

Libtiff: null pointer dereference in tif_dirinfo.c

An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that has progressed, can be determined that it actually is an access control bypass. This may allow any remote unauthenticated user to issue a filter that allows searching for database items they do not have access to, including but not limited to potentially userPassword hashes and other sensitive data.

Kernel: null pointer dereference in nvmet_tcp_build_iovec

Keylime: registrar is subject to a dos against ssl connections

A vulnerability found in jasper. This security vulnerability happens because of a memory leak bug in function cmdopts_parse that can cause a crash or segmentation fault.

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Glibc: dos due to memory leak in getaddrinfo.c

Libsoup: libsoup: denial of service via use-after-free in http/2 server

Corosync: corosync: denial of service via integer overflow in join message validation

A potential memory leak issue was discovered in SDL2 in GLES_CreateTexture() function in SDL_render_gles.c. The vulnerability allows an attacker to cause a denial of service attack. The vulnerability affects SDL2 v2.0.4 and above. SDL-1.x are not affected.

Libxslt: type confusion in xmlnode.psvi between stylesheet and source nodes

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

P11-kit: null dereference via c_derivekey with specific null parameters

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

M2crypto: bleichenbacher timing attacks in the rsa decryption api - incomplete fix for cve-2020-25657

Python-cryptography: bleichenbacher timing oracle attack against rsa decryption - incomplete fix for cve-2020-25659

389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos)

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

JavaScript Cookie: Per-instance prototype hijack in assign() enables cookie-attribute injection

Libxml2: libxml2: denial of service via crafted xsd-validated document

Glib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receive

Cri-o: pods are able to break out of resource confinement on cgroupv2