Red Hat Enterprise Linux Update Services for SAP Solutions 8.8

Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml"

mod_proxy SSRF

The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.

jq: Out-of-Bounds Read in jv_parse_sized() Error Formatting for Non-NUL-Terminated Counted Buffers

crypto: algif_aead - Revert to operating out-of-place

In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.

net: skbuff: preserve shared-frag marker during coalescing

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

Buildah: buildah allows arbitrary directory mount

Insights-client: unsafe handling of temporary files and directories

Subscription-manager: inadequate authorization of com.redhat.rhsm1 d-bus interface allows local users to modify configuration

Apache Tomcat: Fix for CVE-2026-29146 allowed bypass of EncryptInterceptor

dhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND libraries

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

Yelp: arbitrary file read

Xorg: xmayland: value overflow in xkbsetcompatmap()

Xorg: xwayland: use-after-free in xkb client resource removal

Sssd: race condition during authorization leads to gpo policies functioning inconsistently

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr)