K000163013: LibTIFF vulnerabilities CVE-2018-17000, CVE-2018-19210, CVE-2019-7663, CVE-2020-19131, and CVE-2020-19144

Security Advisory Description CVE-2018-17000 A NULL pointer dereference in the function TIFFmemcmp at tifunix.c called from TIFFWriteDirectoryTagTransferfunction in LibTIFF 4.0.9 allows an attacker to cause a denial-of-service through a crafted tiff file. This vulnerability can be triggered by th...

CVE-2026-73137

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

CVE-2026-67567

A flaw was found in the multicloud-operators-subscription component. This vulnerability allows a tenant, who has the ability to create HelmRelease custom resources CRs, to bypass existing security controls. The system's HelmRelease controller processes Helm chart templates using its own elevated...

CVE-2026-74957

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Mitigation bypass in the Safe Browsing component...

CVE-2026-74492

A flaw was found in the Linux kernel's netfilter ipset component. During an ipset hash table resize operation, a race condition can occur where a packet-side add attempts to update a comment. This can lead to a stale pointer being dereferenced, resulting in a kernel crash and a Denial of Service...

CVE-2026-74489

A flaw was found in the Linux kernel's mac80211 component, which manages Wi-Fi Wireless Fidelity networking. This use-after-free vulnerability occurs during the stopping of a Block Acknowledgement BA session. An attacker within the same network segment could exploit this by triggering the BA...

CVE-2026-74389

A flaw was found in the Linux kernel's RDMA/hns component. When the hardware experiences an abnormality, the hnsrocecmdmbox command interface can fail. This failure leads to an uncontrolled flood of error messages, which can consume system resources and ultimately cause a system crash, resulting ...

CVE-2026-74387

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture ALSA sequencer MIDI component. A race condition exists during the teardown of MIDI output with event input processing. This can allow a local attacker to trigger a null pointer dereference or use-after-free condition...

CVE-2026-74386

A flaw was found in the nvmet-tcp component of the Linux kernel. A remote attacker could repeatedly open and close connections, causing a page fragment cache leak. This vulnerability occurs when a connection is closed during the allocation process, leading to memory not being properly released...

CVE-2026-74385

A flaw was found in the nvmet-tcp component of the Linux kernel. This vulnerability arises from ignoring the return value of a function during the TLS handshake, specifically when the network socket is not in an established state. This oversight prevents proper cleanup, leading to the leakage of...

CVE-2026-74384

A flaw was found in the Linux kernel's nvme-multipath component. This vulnerability arises from an incorrect calculation of a flexible array size, currentpath, which is indexed using Non-Uniform Memory Access NUMA node IDs. On certain architectures, such as powerpc, NUMA node IDs can be sparse,...

CVE-2026-74381

A flaw was found in the gpu: host1x component of the Linux kernel. When a buffer object is pinned with a cache, a circular reference prevents the buffer object from being freed. This issue can lead to a resource leak, potentially allowing a local attacker to cause a Denial of Service DoS by...

CVE-2026-74378

A flaw was found in the Linux kernel's RDMA/rxe component. A Time-of-check to time-of-use TOCTOU vulnerability exists where a user-space thread can modify the numsge value after it has been validated but before it is used to calculate a memory copy size. This allows a local attacker to trigger a...

CVE-2026-74351

A flaw was found in the ocfs2 component of the Linux kernel. The lockingstate debugfs iterator incorrectly handles pointers to lock resource blocks LVB. When the original lock resource is freed while the iterator still holds a pointer to it, a use-after-free vulnerability occurs. This can lead to...

CVE-2026-74349

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System version 2 component. A local attacker with appropriate permissions could trigger an issue during filesystem trimming operations. By providing a specific range for trimming that is smaller than expected, an internal calculatio...

CVE-2026-74347

A flaw was found in the Linux kernel's netfilter cttimeout component. This issue arises from the improper management of connection tracking timeout policies. When an iptables ruleset continues to reference a connection tracking timeout policy, new connection tracking entries can repeatedly attach...

CVE-2026-74346

A flaw was found in the Linux kernel's RDMA Remote Direct Memory Access irdma component. During Completion Queue CQ Memory Region MR registration, an internal field was not correctly initialized. This could lead to an out-of-bounds read when handling queue memory, potentially allowing an attacker...

CVE-2026-74343

A flaw was found in the Linux kernel's kernfs component. Multiple superblocks with different namespaces can share the same kernfsnode, leading to a race condition during extended attribute xattr operations. The Virtual File System VFS layer's per-inode locks are insufficient to serialize concurre...

CVE-2026-73137 Multicloud-operators-subscription: multicloud-operators-subscription: cross-namespace secret exfiltration via helmrelease.repo.secretref.namespace

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...

EUVD-2026-63590

A flaw was found in the multicloud-operators-subscription component of Red Hat Advanced Cluster Management RHACM. A tenant with HelmRelease create permissions can exploit this vulnerability by manipulating the secretRef.Namespace field. This allows the GetSecret function in the HelmRelease...