Red Hat Enterprise Linux 9.0

A vulnerability was found in libguestfs. This issue occurs while calculating the greatest possible number of matching keys in the get_keys() function. This flaw leads to a denial of service, either by mistake or malicious actor.

Samba: vfs_worm does not block directory modification

389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request

In Qt before 5.15.14, 6.0.x through 6.2.x before 6.2.9, and 6.3.x through 6.5.x before 6.5.1, QtSvg QSvgFont m_unitsPerEm initialization is mishandled.

A privilege escalation flaw was found in the Ansible Automation Platform. This flaw allows a remote authenticated user with 'change user' permissions to modify the account settings of the superuser account and also remove the superuser privileges.

Gimp: gimp: memory corruption due to integer overflow in ico file handling

Wildfly-core: management user rbac permission allows unexpected reading of system-properties to an unauthorized actor

Keycloak: potential bypass of brute force protection

Libvirt: improper locking in virstoragepoolobjlistsearch may lead to denial of service

Libnbd: crash or misbehaviour when nbd server returns an unexpected block size

Libssh: libssh: denial of service via zero advertised channel packet size

Libssh: libssh: denial of service via oversized sftp read length

Libx11: out-of-bounds memory access in _xkbreadkeysyms()

Kernel: max page sharing of kernel samepage merging (ksm) may cause memory deduplication

Openjpeg: resource exhaustion will occur in the opj_t1_decode_cblks function in the tcd.c

Libsolv: stack-based buffer overflow in libsolv's debian metadata parser when handling sha384/sha512 checksums

Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow

Libssh: double free vulnerability in libssh key export functions

Ipa: invalid csrf protection

Libsolv: heap buffer overflow in libsolv repo_add_solv via negative maxsize from crafted .solv file

Libarchive: libarchive: denial of service via malformed iso file processing

Libkcapi: iv reuse in libkcapi one-shot symmetric cipher chunking causes cipher state reset across chunk boundaries

Openssh: double free in red hat enterprise linux versions of openssh dh-gex client path during fips known-group validation leads to client-side denial of service

Keylime: challenge-response protocol bypass during agent registration

Gimp: gimp: application crash (dos) via crafted psd file due to heap-buffer-overflow

Nbd: nbdkit: integer overflow triggers an assertion resulting in denial of service

Nfs-utils: rpc.mountd in the nfs-utils privilege escalation

Nbdkit: nbdkit-server: off-by-one error when processing block status may lead to a denial of service

Foreman: foreman: cross-tenant private ssh key disclosure via taxonomy scoping bypass

Foreman: foreman: unauthorized modification of host configurations via broken access control

Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding

Libsoup: libsoup: http request smuggling via malformed chunk headers

Community.general: community.general nexmo — api credentials exposed in get url query string[security] community.general nexmo — api credentials exposed in get url query string

Libsoup: libsoup: proxy credentials leak to destination server via proxy-authorization header in connect tunnels

Libsoup: libsoup: heap buffer over-read via integer underflow in soup_filter_input_stream_read_until()

Libsoup: libsoup: header and http request injection via crlf injection

Foreman: satellite: graphql api permission bypass leads to information disclosure

Mutt: neomutt: to and cc email header fields are not protected by cryptographic signing

Qemu: e1000e: heap use-after-free in e1000e_write_packet_to_guest()

Libsoup: libsoup: http header injection and response splitting via crlf injection in content-type header