Red Hat Enterprise Linux Update Services 8.6

mod_proxy SSRF

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force

crypto: algif_aead - Revert to operating out-of-place

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

Buildah: buildah allows arbitrary directory mount

Insights-client: unsafe handling of temporary files and directories

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Rsync: info leak via uninitialized stack contents

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

Yelp: arbitrary file read

Xorg: xmayland: value overflow in xkbsetcompatmap()

Xorg: xwayland: use-after-free in xkb client resource removal

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)