Red Hat Enterprise Linux 8.8

Underflow in PHP-FPM can lead to RCE

Squid: request/response smuggling in http/1.1 and icap

mod_proxy SSRF

Postgresql: buffer overrun from integer overflow in array modification

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

Squid: denial of service in http digest authentication

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Buildah: buildah allows arbitrary directory mount

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Insights-client: unsafe handling of temporary files and directories

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Rsync: info leak via uninitialized stack contents

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222

Glibc: stack read overflow in getaddrinfo in no-aaaa mode

Ipa: invalid csrf protection

Glibc: potential use-after-free in gaih_inet()

Glibc: potential use-after-free in getaddrinfo()

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

Postgresql: role pg_signal_backend can signal certain superuser processes.

Postgresql: memory disclosure in aggregate function calls