Red Hat Enterprise Linux Server AUS 9.2

Squid: request/response smuggling in http/1.1 and icap

Postgresql: buffer overrun from integer overflow in array modification

net-snmp: A buffer overflow in the handling of the INDEX of NET-SNMP-VACM-MIB can cause an out-of-bounds memory access.

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Squid: denial of service in http digest authentication

Squid: denial of service in ftp

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

Glibc: buffer overflow in ld.so leading to privilege escalation

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

Kernel: netfilter: nf_tables_newrule when adding a rule with nfta_rule_chain_id leads to use-after-free

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Buildah: buildah allows arbitrary directory mount

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Insights-client: unsafe handling of temporary files and directories

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Glib: integer overflow in in g_escape_uri_string()

Rsync: info leak via uninitialized stack contents

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Kernel: null pointer dereference in nvmet_tcp_execute_request

Kernel: null pointer dereference in __nvmet_req_complete

Libtiff: null pointer dereference in tif_dirinfo.c

Kernel: null pointer dereference in nvmet_tcp_build_iovec

Keylime: registrar is subject to a dos against ssl connections

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Yelp: arbitrary file read

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

Kernel: out-of-bounds read vulnerability in smbcalcsize

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

Glibc: stack read overflow in getaddrinfo in no-aaaa mode

net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

net-snmp: A malformed OID in a SET request to NET-SNMP-AGENT-MIB::nsLogTable can cause a NULL pointer dereference

net-snmp vulnerable to Improper Input Validation when SETing malformed OIDs in master agent and subagent simultaneously

net-snmp: A malformed OID in a SET request to SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable can cause an out-of-bounds memory access

Ipa: invalid csrf protection

Keylime: challenge-response protocol bypass during agent registration

Glibc: potential use-after-free in gaih_inet()

Glibc: potential use-after-free in getaddrinfo()

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)

Postgresql: role pg_signal_backend can signal certain superuser processes.