Red Hat Enterprise Linux Server 8.8

Underflow in PHP-FPM can lead to RCE

Squid: request/response smuggling in http/1.1 and icap

mod_proxy SSRF

A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with network access to pass specially crafted web content files, causing a denial of service or arbitrary code execution. This CVE exists because of a CVE-2023-28205 security regression for the WebKitGTK package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Squid: denial of service in http digest authentication

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for the emacs package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Buildah: buildah allows arbitrary directory mount

Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling

Insights-client: unsafe handling of temporary files and directories

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Glib: integer overflow in in g_escape_uri_string()

Rsync: info leak via uninitialized stack contents

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

Mariadb: node crashes with transport endpoint is not connected mysqld got signal 6

A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto algorithms, and the response packet is not sent with a zero responder SPI. When a subsequent packet is received where the sender reuses the libreswan responder SPI as its own initiator SPI, the pluto daemon state machine crashes. No remote code execution is possible. This CVE exists because of a CVE-2023-30570 security regression for libreswan package in Red Hat Enterprise Linux 8.8 and Red Hat Enterprise Linux 9.2.

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

Yelp: arbitrary file read

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

Kpatch: mm/mremap.c: incomplete fix for cve-2022-41222

Glibc: potential use-after-free in gaih_inet()

A flaw was found in the grub2-set-bootflag utility of grub2. A local attacker could run this utility under resource pressure (for example by setting RLIMIT), causing grub2 configuration files to be truncated and leaving the system unbootable on subsequent reboots.

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)