Red Hat Enterprise Linux 9.2

Squid: request/response smuggling in http/1.1 and icap

Postgresql: buffer overrun from integer overflow in array modification

net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service

Squid: denial of service in http digest authentication

Squid: denial of service in ftp

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

Glibc: buffer overflow in ld.so leading to privilege escalation

Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions

Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access

Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Buildah: buildah allows arbitrary directory mount

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Insights-client: unsafe handling of temporary files and directories

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty

Rsync: info leak via uninitialized stack contents

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Kernel: null pointer dereference in __nvmet_req_complete

Kernel: null pointer dereference in nvmet_tcp_execute_request

Kernel: null pointer dereference in nvmet_tcp_build_iovec

Keylime: registrar is subject to a dos against ssl connections

Yelp: arbitrary file read

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

Kernel: out-of-bounds read vulnerability in smbcalcsize

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

Glibc: stack read overflow in getaddrinfo in no-aaaa mode

net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

net-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously

net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access

Ipa: invalid csrf protection

Keylime: challenge-response protocol bypass during agent registration

Glibc: potential use-after-free in gaih_inet()

Glibc: potential use-after-free in getaddrinfo()

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)