Red Hat Enterprise Linux

Underflow in PHP-FPM can lead to RCE

Keylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authentication

Squid: request/response smuggling in http/1.1 and icap

mod_proxy SSRF

Postgresql: buffer overrun from integer overflow in array modification

net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.

Squid: denial of service in http digest authentication

Openssh: regresshion - race condition in ssh allows rce/dos

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

Glibc: buffer overflow in ld.so leading to privilege escalation

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by leveraging certain scenarios with a parent-child process relationship, where a parent drops privileges and calls execve (potentially allowing control by an attacker). One contributing factor is an object lifetime issue (which can also cause a panic). Another contributing factor is incorrect marking of a ptrace relationship as privileged, which is exploitable through (for example) Polkit's pkexec helper with PTRACE_TRACEME. NOTE: SELinux deny_ptrace might be a usable workaround in some environments.

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

Buildah: buildah allows arbitrary directory mount

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Insights-client: unsafe handling of temporary files and directories

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

MongoDB Shell may be susceptible to local privilege escalation in Windows

MongoDB Compass may be susceptible to local privilege escalation in Windows

Glib: integer overflow in in g_escape_uri_string()

Rsync: info leak via uninitialized stack contents

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

Rsync: --safe-links option bypass leads to path traversal

Rsync: path traversal vulnerability in rsync

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

Libtiff: null pointer dereference in tif_dirinfo.c

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Yelp: arbitrary file read

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

Glibc: stack read overflow in getaddrinfo in no-aaaa mode

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

net-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously

net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access

Glibc: potential use-after-free in getaddrinfo()

Opensc: side-channel leaks while stripping encryption pkcs#1 padding

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

Ghostscript: incomplete fix for cve-2020-16305