Red Hat Enterprise Linux 9 vulnerabilities
1,050 known vulnerabilities in Red Hat Enterprise Linux 9 from Red Hat. 1,050 are rated high or critical, and 6 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
Red Hat Enterprise Linux 10: Use of Uninitialized Resource
A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialize
- 7.4 High severity
Red Hat Enterprise Linux 10: Covert Timing Channel
A vulnerability was found in Ruby. The Ruby interpreter is vulnerable to the Marvin Attack. This attack allows the attacker to decrypt previously encrypted messages or forge signatures by exchanging a large number of messages with the vulnerable service.
- 7.4 High severity
Fast Datapath for Red Hat Enterprise Linux 8: Out-of-bounds Read
An out-of-bounds read vulnerability was found in DPDK's Vhost library checksum offload feature. This issue enables an untrusted or compromised guest to crash the hypervisor's vSwitch by forging Virtio descriptors to cause out-of-bounds reads. This flaw allows
- 7.4 High severity
Red Hat OpenShift Container Platform 4.15: Improper Authorization
A vulnerability was found in CRI-O, where it can be requested to take a checkpoint archive of a container and later be asked to restore it. When it does that restoration, it attempts to restore the mounts from the restore archive instead of the pod request. As
- 7.8 High severity
Fast Datapath for Red Hat Enterprise Linux 8: Improper Privilege Management
A script injection vulnerability was identified in the Tuned package. The `instance_create()` D-Bus function can be called by locally logged-in users without authentication. This flaw allows a local non-privileged user to execute a D-Bus call with `script_pre`
- 7.5 High severity
Red Hat Enterprise Linux 6: Uncontrolled Resource Consumption
A flaw was found within the handling of SMB2_READ commands in the kernel ksmbd module. The issue results from not releasing memory after its effective lifetime. An attacker can leverage this to create a denial-of-service condition on affected installations of
- 7.5 High severity
Red Hat Enterprise Linux 6: Out-of-bounds Read
A flaw was found within the handling of SMB2 read requests in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to
- 7.5 High severity
Red Hat Enterprise Linux 6: Out-of-bounds Read
A flaw was found within the parsing of SMB2 requests that have a transform header in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacke
- 7.8 High severity
Red Hat Enterprise Linux 6: Heap-based Buffer Overflow
A heap buffer overflow was found in the virtio-snd device in QEMU. When reading input audio in the virtio-snd input callback, virtio_snd_pcm_in_cb, the function did not check whether the iov can fit the data buffer. This issue can trigger an out-of-bounds writ
- 7.5 High severity
Red Hat Enterprise Linux 6: Out-of-bounds Read
A flaw was found within the parsing of extended attributes in the kernel ksmbd module. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated buffer. An attacker can leverage this to
- 7.4 High severity
Red Hat Enterprise Linux 8: Improper Authentication
A flaw was found in pam_access, where certain rules in its configuration file are mistakenly treated as hostnames. This vulnerability allows attackers to trick the system by pretending to be a trusted hostname, gaining unauthorized access. This issue poses a r
- 7.8 High severity
Red Hat Enterprise Linux 10: Heap-based Buffer Overflow
A flaw was found in the X.org server. Due to improperly tracked allocation size in _XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation
- 7.8 High severity
Red Hat Enterprise Linux 7.7 Advanced Update…: Improper Control of Generation of Code
A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails
- 8.2 High severity
Red Hat Enterprise Linux 8: Improper Link Resolution Before File Access
A flaw was found in Go. When FIPS mode is enabled on a system, container runtimes may incorrectly handle certain file paths due to improper validation in the containers/common Go library. This flaw allows an attacker to exploit symbolic links and trick the sys
- 7.5 High severity
Red Hat Enterprise Linux 9: Uncontrolled Resource Consumption
A flaw was found in Aardvark-dns, which is vulnerable to a Denial of Service attack due to the serial processing of TCP DNS queries. An attacker can exploit this flaw by keeping a TCP connection open indefinitely, causing the server to become unresponsive and
- 7.5 High severity
Red Hat Enterprise Linux 10: Exposure of Data Element to Wrong Session
A flaw was found in the gnome-remote-desktop package. The gnome-remote-desktop system daemon performs inadequate validation of session agents using D-Bus methods related to transitioning a client connection from the login screen to the user session. As a resul
- 7.5 High severity
Red Hat Enterprise Linux 8: NULL Pointer Dereference
A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. T
- 7.5 High severity
Red Hat Enterprise Linux 8: Improper Synchronization
A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.
- 7.4 High severity
Red Hat Enterprise Linux 8: Improper Certificate Validation
A flaw was found in libnbd. The client did not always correctly verify the NBD server's certificate when using TLS to connect to an NBD server. This issue allows a man-in-the-middle attack on NBD traffic.
- 7.0 High severity
Red Hat Enterprise Linux 8: Improper Control of Generation of Code
A flaw was found in the GTK library. Under certain conditions, it is possible for a library to be injected into a GTK application from the current working directory.
- 7.0 High severity
Red Hat Enterprise Linux 9: Signal Handler Race Condition
A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls v
- 7.8 High severity
Advanced Virtualization for RHEL 8.2.1: Out-of-bounds Write
A flaw was found in the QEMU disk image utility (qemu-img) 'info' command. A specially crafted image file containing a `json:{}` value describing block devices in QMP could cause the qemu-img process on the host to consume large amounts of memory or CPU time,
- 8.1 High severity
Red Hat Enterprise Linux 9: Concurrent Execution using Shared Resource with Improper Synchronization
A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate
- 7.5 High severity
A flaw was found in the Poppler's Pdfinfo utility.
A flaw was found in the Poppler's Pdfinfo utility. This issue occurs when using -dests parameter with pdfinfo utility. By using certain malformed input files, an attacker could cause the utility to crash, leading to a denial of service.
- 8.1 High severity
Red Hat OpenShift Container Platform 4.12: Improper Limitation of a Pathname to a Restricted Directory
A flaw was found in cri-o. A malicious container can create a symbolic link to arbitrary files on the host via directory traversal (“../“). This flaw allows the container to read and write to arbitrary files on the host system.
- 8.1 High severity
Red Hat Enterprise Linux 7: Use of Password Hash With Insufficient Computational Effort
A vulnerability was found in FreeIPA in a way when a Kerberos TGS-REQ is encrypted using the client’s session key. This key is different for each new session, which protects it from brute force attacks. However, the ticket it contains is encrypted using the ta
- 8.8 High severity
Red Hat Enterprise Linux 8: Incorrect Authorization
A vulnerability was found in FreeIPA in how the initial implementation of MS-SFU by MIT Kerberos was missing a condition for granting the "forwardable" flag on S4U2Self tickets. Fixing this mistake required adding a special case for the check_allowed_to_delega
- 7.5 High severity
Red Hat Certificate System 10.4 EUS for RHEL-8: Authentication Bypass by Primary Weakness
A flaw was found in dogtag-pki and pki-core. The token authentication scheme can be bypassed with a LDAP injection. By passing the query string parameter sessionID=*, an attacker can authenticate with an existing session saved in the LDAP directory server, whi
- 8.1 High severity
Red Hat Enterprise Linux 10: Buffer Copy without Checking Size of Input
A vulnerability was found in libndp. This flaw allows a local malicious user to cause a buffer overflow in NetworkManager, triggered by sending a malformed IPv6 router advertisement packet. This issue occurred as libndp was not correctly validating the route l
- 7.5 High severity
A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a…
A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service
- 8.3 High severity
OADP-1.3-RHEL-9: Improper Validation of Integrity Check Value
A flaw was found in the github.com/containers/image library. This flaw allows attackers to trigger unexpected authenticated registry accesses on behalf of a victim user, causing resource exhaustion, local path traversal, and other attacks.
- 7.1 High severity
Red Hat Enterprise Linux 8: Concurrent Execution using Shared Resource with Improper Synchronization
A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately.
- 8.2 High severity
Red Hat Enterprise Linux 8: Double Free
A double free vulnerability was found in QEMU virtio devices (virtio-gpu, virtio-serial-bus, virtio-crypto), where the mem_reentrancy_guard flag insufficiently protects against DMA reentrancy issues. This issue could allow a malicious privileged guest user to
- 7.8 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Use After Free
A use-after-free vulnerability was found in the ProcRenderAddGlyphs() function of Xorg servers. This issue occurs when AllocateGlyph() is called to store new glyphs sent by the client to the X server, potentially resulting in multiple entries pointing to the s
- 7.3 High severity
Red Hat Enterprise Linux 10: Buffer Over-read
A heap-based buffer over-read vulnerability was found in the X.org server's ProcAppleDRICreatePixmap() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly
- 7.3 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Buffer Over-read
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIPassiveGrabDevice() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly w
- 7.3 High severity
Red Hat Enterprise Linux 6 Extended Lifecycle…: Buffer Over-read
A heap-based buffer over-read vulnerability was found in the X.org server's ProcXIGetSelectedEvents() function. This issue occurs when byte-swapped length values are used in replies, potentially leading to memory leakage and segmentation faults, particularly w
- 10.0 Critical severity
Red Hat Enterprise Linux 10: Embedded Malicious Code
Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. Through a series of complex obfuscations, the liblzma build process extracts a prebuilt object file from a disguised test file existing in the source code, which is then
- 8.8 High severity
Red Hat Enterprise Linux 8: Exposure of Resource to Wrong Sphere
A flaw was found in PCP. The default pmproxy configuration exposes the Redis server backend to the local network, allowing remote command execution with the privileges of the Redis user. This issue can only be exploited when pmproxy is running. By default, pmp
- 7.3 High severity
Red Hat Enterprise Linux 8: Improper Neutralization of Special Elements used in a Command
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.