Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support vulnerabilities
414 known vulnerabilities in Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support from Red Hat. 414 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 8.2 High severity
Red Hat Enterprise Linux 10: Inconsistent Interpretation of HTTP Requests
A flaw in libsoup’s HTTP header handling allows multiple Host: headers in a request and returns the last occurrence for server-side processing. Common front proxies often honor the first Host: header, so this mismatch can cause vhost confusion where a proxy ro
- 9.8 Critical severity
glib: Integer Overflow or Wraparound
A flaw was found in GLib (Gnome Lib). This vulnerability allows a remote attacker to cause heap corruption, leading to a denial of service or potential code execution via a buffer-underflow in the GVariant parser when processing maliciously crafted input strin
- 7.4 High severity
webkitgtk: Origin Validation Error
A flaw was found in WebKitGTK. This vulnerability allows remote, user-assisted information disclosure that can reveal any file the user is permitted to read via abusing the file drag-and-drop mechanism where WebKitGTK does not verify that drag operations origi
- 7.7 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable characters (which would need escaping), the calcu
- 7.5 High severity
webkitgtk: Out-of-bounds Read
A flaw was found in WebKitGTK and WPE WebKit. This vulnerability allows an out-of-bounds read and integer underflow, leading to a UIProcess crash (DoS) via a crafted payload to the GLib remote inspector server.
- 7.8 High severity
grub2: Use After Free
A Use-After-Free vulnerability has been discovered in GRUB's gettext module. This flaw stems from a programming error where the gettext command remains registered in memory after its module is unloaded. An attacker can exploit this condition by invoking the or
- 8.6 High severity
kdcproxy: Server-Side Request Forgery
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, sin
- 8.8 High severity
Safari: Use After Free
A use-after-free issue was addressed with improved memory management. This issue is fixed in Safari 26.1, iOS 26.1 and iPadOS 26.1, macOS Tahoe 26.1, visionOS 26.1, watchOS 26.1. Processing maliciously crafted web content may lead to an unexpected Safari crash
- 7.3 High severity
Xwayland: Use After Free
A flaw was discovered in the X.Org X server’s X Keyboard (Xkb) extension when handling client resource cleanup. The software frees certain data structures without properly detaching related resources, leading to a use-after-free condition. This can cause memor
- 7.3 High severity
Xwayland: Use After Free
A flaw was found in the X.Org X server and Xwayland when processing X11 Present extension notifications. Improper error handling during notification creation can leave dangling pointers that lead to a use-after-free condition. This can cause memory corruption
- 7.3 High severity
Xwayland: Integer Overflow or Wraparound
A flaw was identified in the X.Org X server’s X Keyboard (Xkb) extension where improper bounds checking in the XkbSetCompatMap() function can cause an unsigned short overflow. If an attacker sends specially crafted input data, the value calculation may overflo
- 8.8 High severity
Red Hat Enterprise Linux 10: Improper Privilege Management
A flaw was found in the integration of Active Directory and the System Security Services Daemon (SSSD) on Linux systems. In default configurations, the Kerberos local authentication plugin (sssd_krb5_localauth_plugin) is enabled, but a fallback to the an2ln pl
- 7.5 High severity
Red Hat Enterprise Linux 10: Use After Free
A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by
- 9.1 Critical severity
Red Hat Enterprise Linux 10: Insufficient Granularity of Access Control
A privilege escalation flaw from host to domain administrator was found in FreeIPA. This vulnerability is similar to CVE-2025-4404, where it fails to validate the uniqueness of the krbCanonicalName. While the previously released version added validations for t
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in the cookie date handling logic of the libsoup HTTP library, widely used by GNOME and other applications for web communication. When processing cookies with specially crafted expiration dates, the library may perform an out-of-bounds memory
- 8.8 High severity
Red Hat Enterprise Linux 10: Write-what-where Condition
A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted TIFF image file. By providing an abnormally large image height value in the file's metadata, an attacker can trick the l
- 8.5 High severity
udisks: Out-of-bounds Read
A flaw was found in the Udisks daemon, where it allows unprivileged users to create loop devices using the D-BUS system. This is achieved via the loop device handler, which handles requests sent through the D-BUS interface. As two of the parameters of this han
- 7.8 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in linux-pam. The pam_namespace module may improperly handle user-controlled paths, allowing local users to exploit symlink attacks and race conditions to elevate their privileges to root. This CVE provides a "complete" fix for CVE-2025-6020.
- 8.8 High severity
Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- 8.8 High severity
Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to an unexpected Safari crash.
- 8.8 High severity
Apple Multiple Products Buffer Overflow Exploited
The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, visionOS 2.6, watchOS 11.6. Processing maliciously crafted web content may lead to memory corruption.
- 7.8 High severity
libxml2: Use After Free
A flaw was found in libxslt where the attribute type, atype, flags are modified in a way that corrupts internal memory management. When XSLT functions, such as the key() process, result in tree fragments, this corruption prevents the proper cleanup of ID attri
- 7.5 High severity
Red Hat Enterprise Linux 10: Buffer Copy without Checking Size of Input
A flaw exists in gdk‑pixbuf within the gdk_pixbuf__jpeg_image_load_increment function (io-jpeg.c) and in glib’s g_base64_encode_step (glib/gbase64.c). When processing maliciously crafted JPEG images, a heap buffer overflow can occur during Base64 encoding, all
- 8.8 High severity
libssh: Incorrect Calculation
A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses
- 8.1 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in the libssh library in versions less than 0.11.2. An out-of-bounds read can be triggered in the sftp_handle function due to an incorrect comparison check that permits the function to access memory beyond the valid handle list and to return a
- 7.0 High severity
Red Hat Enterprise Linux 10: Execution with Unnecessary Privileges
A Local Privilege Escalation (LPE) vulnerability was found in libblockdev. Generally, the "allow_active" setting in Polkit permits a physically present user to take certain actions based on the session type. Due to the way libblockdev interacts with the udisks
- 7.8 High severity
xwayland: Integer Overflow or Wraparound
A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.
- 7.3 High severity
xwayland: Integer Overflow or Wraparound
A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.
- 7.3 High severity
xwayland: Integer Overflow or Wraparound
A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.
- 9.1 Critical severity
Red Hat Enterprise Linux 10: Insufficient Granularity of Access Control
A privilege escalation from host to domain vulnerability was found in the FreeIPA project. The FreeIPA package fails to validate the uniqueness of the `krbCanonicalName` for the admin account by default, allowing users to create services with the same canonica
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in linux-pam. The module pam_namespace may use access user-controlled paths without proper protection, allowing local users to elevate their privileges to root via multiple symlink attacks and race conditions.
- 9.1 Critical severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A vulnerability was found in libxml2. Processing certain sch:name elements from the input XML file can trigger a memory corruption issue. This flaw allows an attacker to craft a malicious XML input file that can lead libxml to crash, resulting in a denial of s
- 9.1 Critical severity
Red Hat Enterprise Linux 10: Expired Pointer Dereference
A use-after-free vulnerability was found in libxml2. This issue occurs when parsing XPath elements under certain circumstances when the XML schematron has the <sch:name path="..."/> schema elements. This flaw allows a malicious actor to craft a malicious XML d
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
- 7.8 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerabil
- 7.3 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Use After Free
A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free
- 7.3 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Heap-based Buffer Overflow
A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap
- 7.4 High severity
Red Hat Enterprise Linux 10: Uncontrolled Resource Consumption
A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result
- 7.5 High severity
Red Hat Enterprise Linux 10: Integer Underflow (Wrap or Wraparound)
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart message
- 8.8 High severity
Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer
The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.