Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support vulnerabilities
414 known vulnerabilities in Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support from Red Hat. 414 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Red Hat Enterprise Linux 8: Uncaught Exception
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistentl
- 9.0 Critical severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Free of Memory not on the Heap
A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
- 7.4 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
- 7.5 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: NULL Pointer Dereference
A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
- 7.4 High severity
Red Hat Enterprise Linux 8: URL Redirection to Untrusted Site
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
- 7.5 High severity
Red Hat Enterprise Linux 10: Allocation of Resources Without Limits or Throttling
A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).
- 7.5 High severity
Red Hat Enterprise Linux 10: Uncontrolled Recursion
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting t
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes trigger
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
- 7.8 High severity
Red Hat Enterprise Linux 10: Access of Uninitialized Pointer
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree m
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the las
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Restriction of Operations within the Bounds of a Memory Buffer
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
- 7.6 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Out-of-bounds Write
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to c
- 8.8 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Improper Neutralization of Special Elements used in an OS Command
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or a
- 7.5 High severity
Red Hat Enterprise Linux 10: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--in
- 7.5 High severity
Red Hat Enterprise Linux 10: Use of Uninitialized Resource
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialize
- 7.8 High severity
Red Hat Enterprise Linux 10: Heap-based Buffer Overflow
A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation
- 7.8 High severity
Red Hat Enterprise Linux 7.7 Advanced Update…: Improper Control of Generation of Code
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails
- 7.8 High severity
Advanced Virtualization for RHEL 8.2.1: Out-of-bounds Write
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time,
- 8.1 High severity
Red Hat Enterprise Linux 7: Use of Password Hash With Insufficient Computational Effort
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the ta
- 7.5 High severity
Red Hat Certificate System 10.4 EUS for RHEL-8: Authentication Bypass by Primary Weakness
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, whi
- 8.1 High severity
Red Hat Enterprise Linux 10: Buffer Copy without Checking Size of Input
A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route l
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Use After Free
A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the s
- 7.3 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Buffer Over-read
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly w
- 7.3 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Buffer Over-read
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly w
- 8.8 High severity
Red Hat Enterprise Linux 8: Exposure of Resource to Wrong Sphere
A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmp
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Heap-based Buffer Overflow
A heap buffer overflow flaw was found in the DisableDevice function in the X.Org server. This issue may lead to an application crash or, in some circumstances, remote code execution in SSH X11 forwarding environments.
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Heap-based Buffer Overflow
A flaw was found in X.Org server. In the XISendDeviceHierarchyEvent function, it is possible to exceed the allocated array length when certain new device IDs are added to the xXIHierarchyInfo struct. This can trigger a heap buffer overflow condition, which may
- 7.3 High severity
Red Hat Enterprise Linux 8: Incorrect Default Permissions
A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbou
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Out-of-bounds Write
An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the serve
- 8.6 High severity
runc: Exposure of Resource to Wrong Sphere
runc is a CLI tool for spawning and running containers on Linux according to the OCI specification. In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a workin
- 7.4 High severity
Red Hat Enterprise Linux 7: Integer Overflow or Wraparound
A buffer overflow was found in Shim in the 32-bit system. The overflow happens due to an addition operation involving a user-controlled value parsed from the PE binary being used by Shim. This value is further used for memory allocation operations, leading to
- 8.3 High severity
Red Hat Enterprise Linux 7: Origin Validation Error
A remote code execution vulnerability was found in Shim. The Shim boot support trusts attacker-controlled values when parsing an HTTP response. This flaw allows an attacker to craft a specific malicious HTTP request, leading to a completely controlled out-of-b
- 9.8 Critical severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Out-of-bounds Write
A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's
- 7.8 High severity
Red Hat Enterprise Linux 8: Out-of-bounds Write
An out-of-bounds memory write flaw was found in the Linux kernel’s Transport Layer Security functionality in how a user calls a function splice with a ktls socket as the destination. This flaw allows a local user to crash or potentially escalate their privileg
- 7.0 High severity
Red Hat Enterprise Linux 8: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition was found in the GSM 0710 tty multiplexor in the Linux kernel. This issue occurs when two threads execute the GSMIOC_SETCONF ioctl on the same tty file descriptor with the gsm line discipline enabled, and can lead to a use-after-free problem o