Red Hat Enterprise Linux 9 vulnerabilities
1,050 known vulnerabilities in Red Hat Enterprise Linux 9 from Red Hat. 1,050 are rated high or critical, and 6 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A flaw was found in how GLib’s GString manages memory when adding data to strings. If a string is already very large, combining it with more input can cause a hidden overflow in the size calculation. This makes the system think it has enough memory when it doe
- 7.8 High severity
Red Hat Enterprise Linux 6: Integer Overflow or Wraparound
A flaw was found in GIMP. An integer overflow vulnerability exists in the GIMP "Despeckle" plug-in. The issue occurs due to unchecked multiplication of image dimensions, such as width, height, and bytes-per-pixel (img_bpp), which can result in allocating insuf
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.
- 7.8 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A vulnerability has been identified in the libarchive library, specifically within the archive_read_format_rar_seek_data() function. This flaw involves an integer overflow that can ultimately lead to a double-free condition. Exploiting a double-free vulnerabil
- 7.1 High severity
Red Hat OpenShift sandboxed containers 1.10: Incorrect Privilege Assignment
A flaw was found in the user's crate for Rust. This vulnerability allows privilege escalation via incorrect group listing when a user or process has fewer than exactly 1024 groups, leading to the erroneous inclusion of the root group in the access list.
- 7.0 High severity
Red Hat Enterprise Linux 10: Buffer Copy without Checking Size of Input
A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.
- 7.3 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Use After Free
A flaw was found in GIMP when processing XCF image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing use-after-free
- 7.3 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Heap-based Buffer Overflow
A flaw was found in GIMP when processing certain TGA image files. If a user opens one of these image files that has been specially crafted by an attacker, GIMP can be tricked into making serious memory errors, potentially leading to crashes and causing a heap
- 7.3 High severity
Red Hat Enterprise Linux 6: Stack-based Buffer Overflow
A flaw was found in GIMP. The GIMP ani_load_image() function is vulnerable to a stack-based overflow. If a user opens.ANI files, GIMP may be used to store more information than the capacity allows. This flaw allows a malicious ANI file to trigger arbitrary cod
- 7.4 High severity
Red Hat Enterprise Linux 10: Uncontrolled Resource Consumption
A flaw was found in gnome-remote-desktop. Once gnome-remote-desktop listens for RDP connections, an unauthenticated attacker can exhaust system resources and repeatedly crash the process. There may be a resource leak after many attacks, which will also result
- 7.5 High severity
Red Hat Enterprise Linux 10: Integer Underflow (Wrap or Wraparound)
A flaw was found in the soup_multipart_new_from_message() function of the libsoup HTTP library, which is commonly used by GNOME and other applications to handle web communications. The issue occurs when the library processes specially crafted multipart message
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Handling of Insufficient Permissions or Privileges
A flaw was found in Yggdrasil, which acts as a system broker, allowing the processes to communicate to other children's "worker" processes through the DBus component. Yggdrasil creates a DBus method to dispatch messages to workers. However, it misses authentic
- 8.8 High severity
Safari: Improper Restriction of Operations within the Bounds of a Memory Buffer
The issue was addressed with improved checks. This issue is fixed in Safari 18.5, iOS 18.5 and iPadOS 18.5, macOS Sequoia 15.5, tvOS 18.5, visionOS 2.5, watchOS 11.5. Processing maliciously crafted web content may lead to memory corruption.
- 7.5 High severity
Red Hat Enterprise Linux 8: Uncaught Exception
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistentl
- 9.0 Critical severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Free of Memory not on the Heap
A use-after-free type vulnerability was found in libsoup, in the soup_message_headers_get_content_disposition() function. This flaw allows a malicious HTTP client to cause memory corruption in the libsoup server.
- 7.4 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.
- 7.5 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: NULL Pointer Dereference
A flaw was found in libsoup, where the soup_message_headers_get_content_disposition() function is vulnerable to a NULL pointer dereference. This flaw allows a malicious HTTP peer to crash a libsoup client or server that uses this function.
- 7.5 High severity
Red Hat Enterprise Linux 10: Misinterpretation of Input
A flaw was found in libsoup. The HTTP/2 server in libsoup may not fully validate the values of pseudo-headers :scheme, :authority, and :path, which may allow a user to cause a denial of service (DoS).
- 7.5 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Read
A flaw was found in libsoup, where the soup_headers_parse_request() function may be vulnerable to an out-of-bound read. This flaw allows a malicious user to use a specially crafted HTTP request to crash the HTTP server.
- 7.4 High severity
Red Hat Enterprise Linux 8: URL Redirection to Untrusted Site
A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.
- 7.5 High severity
Red Hat Enterprise Linux 10: Allocation of Resources Without Limits or Throttling
A flaw was found in libsoup. The SoupWebsocketConnection may accept a large WebSocket message, which may cause libsoup to allocate memory and lead to a denial of service (DoS).
- 7.5 High severity
Red Hat Enterprise Linux 10: Uncontrolled Recursion
A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting t
- 7.8 High severity
Red Hat Enterprise Linux 10: Integer Overflow or Wraparound
A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciou
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A flaw was found in the HFS filesystem. When reading an HFS volume's name at grub_fs_mount(), the HFS filesystem driver performs a strcpy() using the user-provided volume name as input without properly validating the volume name's length. This issue may read t
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
When reading data from a hfs filesystem, grub's hfs filesystem module uses user-controlled parameters from the filesystem metadata to calculate the internal buffers size, however it misses to properly check for integer overflows. A maliciouly crafted filesyste
- 7.8 High severity
Red Hat Enterprise Linux 10: Buffer Copy without Checking Size of Input
When reading data from disk, the grub's UDF filesystem module utilizes the user controlled data length metadata to allocate its internal buffers. In certain scenarios, while iterating through disk sectors, it assumes the read size from the disk is always small
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. When changing an alarm, the values of the change mask are evaluated one after the other, changing the trigger values as requested, and eventually, SyncInitTrigger() is called. If one of the changes trigger
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. When a device is removed while still frozen, the events queued for that device remain while the device is freed. Replaying the events will cause a use-after-free.
- 7.8 High severity
Red Hat Enterprise Linux 10: Access of Uninitialized Pointer
An access to an uninitialized pointer flaw was found in X.Org and Xwayland. The function compCheckRedirect() may fail if it cannot allocate the backing pixmap. In that case, compRedirectWindow() will return a BadAlloc error without validating the window tree m
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
An out-of-bounds write flaw was found in X.Org and Xwayland. The function GetBarrierDevice() searches for the pointer device based on its device ID and returns the matching value, or supposedly NULL, if no match was found. However, the code will return the las
- 7.8 High severity
Red Hat Enterprise Linux 10: Improper Restriction of Operations within the Bounds of a Memory Buffer
A buffer overflow flaw was found in X.Org and Xwayland. If XkbChangeTypesOfKey() is called with a 0 group, it will resize the key symbols table to 0 but leave the key actions unchanged. If the same function is later called with a non-zero value of groups, this
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A heap overflow flaw was found in X.Org and Xwayland. The computation of the length in XkbSizeKeySyms() differs from what is written in XkbWriteKeySyms(), which may lead to a heap-based buffer overflow.
- 7.8 High severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A buffer overflow flaw was found in X.Org and Xwayland. The code in XkbVModMaskText() allocates a fixed-sized buffer on the stack and copies the names of the virtual modifiers to that buffer. The code fails to check the bounds of the buffer and would copy the
- 7.8 High severity
Red Hat Enterprise Linux 10: Use After Free
A use-after-free flaw was found in X.Org and Xwayland. The root cursor is referenced in the X server as a global variable. If a client frees the root cursor, the internal reference points to freed memory and causes a use-after-free.
- 7.6 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Out-of-bounds Write
A flaw was found in grub2. During the network boot process, when trying to search for the configuration file, grub copies data from a user controlled environment variable into an internal buffer using the grub_strcpy() function. During this step, it fails to c
- 8.8 High severity
Red Hat Enterprise Linux 7 Extended Lifecycle…: Improper Neutralization of Special Elements used in an OS Command
A command injection flaw was found in the text editor Emacs. It could allow a remote, unauthenticated attacker to execute arbitrary shell commands on a vulnerable system. Exploitation is possible by tricking users into visiting a specially crafted website or a
- 8.6 High severity
Red Hat Enterprise Linux 8: Improper Privilege Management
A vulnerability was found in `podman build` and `buildah.` This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumer
- 9.8 Critical severity
Red Hat Enterprise Linux 10: Out-of-bounds Write
A heap-based buffer overflow flaw was found in the rsync daemon. This issue is due to improper handling of attacker-controlled checksum lengths (s2length) in the code. When MAX_DIGEST_LEN exceeds the fixed SUM_LENGTH (16 bytes), an attacker can write out of bo
- 7.5 High severity
Red Hat Enterprise Linux 10: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may l
- 7.5 High severity
Red Hat Enterprise Linux 10: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--in