Enterprise Linux vulnerabilities
285 known vulnerabilities in Enterprise Linux from Red Hat. 284 are rated high or critical, and 26 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Red Hat Enterprise Linux 8: Observable Discrepancy
A vulnerability was found in GnuTLS. The response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from the response times of ciphertexts with correct PKCS#1 v1.5 padding. This issue may allow a remote attacker to perform a timing side-channe
- 7.8 High severity
Red Hat Enterprise Linux 8.6 Extended Update…: Use After Free
A use-after-free flaw was found in the Linux Kernel. When a disk is removed, bdi_unregister is called to stop further write-back and waits for associated delayed work to complete. However, wb_inode_writeback_end() may schedule bandwidth estimation work after t
- 7.0 High severity
Red Hat Enterprise Linux 8: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem o
- 7.8 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Write
A vulnerability was found in perl 5.30.0 through 5.38.0. This issue occurs when a crafted regular expression is compiled by perl, which can allow an attacker controlled byte buffer overflow in a heap allocated buffer.
- 8.8 High severity
Red Hat Advanced Cluster Security 4.2: Integer Overflow or Wraparound
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user ca
- 7.1 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Read
An out-of-bounds read vulnerability was found in smb2_dump_detail in fs/smb/client/smb2ops.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
- 7.1 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Read
An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.
- 7.0 High severity
Red Hat Enterprise Linux 8: Improper Synchronization
A bug in QEMU could cause a guest I/O operation otherwise addressed to an arbitrary disk offset to be targeted to offset 0 instead (potentially overwriting the VM's boot code). This could be used, for example, by L2 guests with a virtual disk (vdiskL2) stored
- 9.8 Critical severity
Red Hat Enterprise Linux 8: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB clients to remote procedure call (RPC) services like SAMR
- 7.0 High severity
Red Hat Enterprise Linux 8: Use After Free
A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between rmap walk and mremap, allowing a local user to crash the system or potentially escalate their privile
- 7.5 High severity
Red Hat Enterprise Linux 8: Improper Handling of Exceptional Conditions
A flaw was found in Squid. The limits applied for validation of HTTP response headers are applied before caching. However, Squid may grow a cached HTTP response header beyond the configured maximum size, causing a stall or crash of the worker process when a la
- 7.5 High severity
Red Hat Enterprise Linux 9: Incorrect Conversion between Numeric Types
Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs from FTP Native input.
- 7.5 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Buffer Copy without Checking Size of Input
Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory when Squid is configured to accept HTTP Digest Authentication.
- 8.8 High severity
Red Hat Enterprise Linux 8: Use After Free
A use-after-free vulnerability was found in drivers/nvme/target/tcp.c` in `nvmet_tcp_free_crypto` due to a logical bug in the NVMe/TCP subsystem in the Linux kernel. This issue may allow a malicious user to cause a use-after-free and double-free problem, which
- 7.8 High severity
Red Hat Enterprise Linux 7: Exposure of Resource to Wrong Sphere
A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege escalation. Before the insights-client has been registered on the sy
- 7.0 High severity
Red Hat Enterprise Linux 9: Use After Free
A use-after-free flaw was found in xorg-x11-server-Xvfb. This issue occurs in Xvfb with a very specific and legacy configuration (a multi-screen setup with multiple protocol screens, also known as Zaphod mode). If the pointer is warped from a screen 1 to a scr
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Out-of-bounds Write
A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty function in Xi/xiproperty.c and in RRChangeOutputProperty funct
- 7.8 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Write
An out-of-bounds write flaw was found in grub2's NTFS filesystem driver. This issue may allow an attacker to present a specially crafted NTFS filesystem image, leading to grub's heap metadata corruption. In some circumstances, the attack may also corrupt the U
- 7.8 High severity
Red Hat Enterprise Linux 8: Use After Free
The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being used to store a surface. When running inside a VMware guest with 3D acceleration e
- 7.7 High severity
Red Hat Enterprise Linux 8: Protection Mechanism Failure
A flaw was found in the tracker-miners package. A weakness in the sandbox allows a maliciously-crafted file to execute code outside the sandbox if the tracker-extract process has first been compromised by a separate vulnerability.
- 7.8 High severity
Red Hat Enterprise Linux 8: Integer Overflow or Wraparound
A vulnerability was found in libX11 due to an integer overflow within the XCreateImage() function. This flaw allows a local user to trigger an integer overflow and execute arbitrary code with elevated privileges.
- 8.2 High severity
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel.
An improper input validation flaw was found in the eBPF subsystem in the Linux kernel. The issue occurs due to a lack of proper validation of dynamic pointers within user-supplied eBPF programs prior to executing them. This may allow an attacker with CAP_BPF p
- 7.8 High severity
GNU C Library Buffer Overflow Exploited
A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment variables when launching binari
- 8.8 High severity
Google Chromium libvpx Heap Buffer Overflow Exploited
Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- 7.8 High severity
Red Hat Enterprise Linux 7: Out-of-bounds Write
An array indexing vulnerability was found in the netfilter subsystem of the Linux kernel. A missing macro could lead to a miscalculation of the `h->nets` array offset, providing attackers with the primitive to arbitrarily increment/decrement a memory buffer ou
- 7.1 High severity
gawk: Out-of-bounds Read
A heap out-of-bounds read flaw was found in builtin.c in the gawk package. This issue may lead to a crash and could be used to read sensitive information.
- 7.5 High severity
Red Hat Enterprise Linux 6: Missing Release of Memory after Effective Lifetime
A flaw was found in the GNU C Library. A recent fix for CVE-2023-4806 introduced the potential for a memory leak, which may result in an application crash.
- 8.2 High severity
qemu: Use After Free
This CVE exists because of an incomplete fix for CVE-2021-3750. More specifically, the qemu-kvm package as released for Red Hat Enterprise Linux 9.1 via RHSA-2022:7967 included a version of qemu-kvm that was actually missing the fix for CVE-2021-3750.
- 7.8 High severity
Red Hat Enterprise Linux 7: Incorrect Authorization
A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration.
- 7.1 High severity
Red Hat Enterprise Linux 8: Use After Free
A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash the system due to a double-free while cleaning up vmxn
- 8.8 High severity
Red Hat Advanced Cluster Security 4.2: Improper Neutralization of Special Elements used in an SQL Command
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-
- 7.8 High severity
Red Hat Enterprise Linux 9: Use After Free
A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to crash or escalate their privileges on the system.
- 7.8 High severity
Red Hat Enterprise Linux 8: Use After Free
A use-after-free flaw was found in the Linux kernel's netfilter in the way a user triggers the nft_pipapo_remove function with the element, without a NFT_SET_EXT_KEY_END. This issue could allow a local user to crash the system or potentially escalate their pri
- 7.8 High severity
Red Hat Enterprise Linux 8: Use After Free
An out-of-bounds memory access flaw was found in the Linux kernel’s TUN/TAP device driver functionality in how a user generates a malicious (too big) networking packet when napi frags is enabled. This flaw allows a local user to crash or potentially escalate t
- 7.8 High severity
Red Hat Enterprise Linux 6: Observable Discrepancy
A possible unauthorized memory access flaw was found in the Linux kernel's cpu_entry_area mapping of X86 CPU data to memory, where a user may guess the location of exception stacks or other important data. Based on the previous CVE-2023-0597, the 'Randomize pe
- 7.1 High severity
Red Hat Enterprise Linux 8: Use After Free
A use-after-free flaw was found in vcs_read in drivers/tty/vt/vc_screen.c in vc_screen in the Linux Kernel. This issue may allow an attacker with local user access to cause a system crash or leak internal kernel information.
- 7.5 High severity
Red Hat Enterprise Linux 9: Excessive Iteration
A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This flaw allows an attacker to exhaust all available connections.
- 7.5 High severity
Red Hat Enterprise Linux 8: Loop with Unreachable Exit Condition
An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight. When parsing Spotlight mdssvc RPC packets sent by the client, the core unmarshalling function sl_unpack_loop() did not validate a field in the network packet that contains th
- 7.5 High severity
qemu: NULL Pointer Dereference
A flaw was found in the QEMU built-in VNC server. When a client connects to the VNC server, QEMU checks whether the current number of connections crosses a certain threshold and if so, cleans up the previous connection. If the previous connection happens to be
- 7.8 High severity
kernel: Use After Free
A vulnerability exists in the memory management subsystem of the Linux kernel. The lock handling for accessing and updating virtual memory areas (VMAs) is incorrect, leading to use-after-free problems. This issue can be successfully exploited to execute arbitr