131819 matches found
expat: Expat: Denial of Service via quadratic complexity in attribute processing
A flaw was found in the Expat XML parsing library. A remote, unauthenticated attacker can supply a specially crafted XML document to trigger quadratic algorithmic complexity in the storeAtts function, causing excessive CPU consumption and a denial of service...
Important: Red Hat Security Advisory: expat security update
An update for expat is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from th...
expat: Expat: XML Injection via Malformed UTF-16 Input
A flaw was found in Expat. This vulnerability allows a remote attacker to send specially crafted UTF-16 encoded XML data. Due to improper validation of surrogate characters, the parser can be tricked into accepting malformed sequences, which can hide legitimate markup characters. This could enabl...
Important: Red Hat Security Advisory: OpenShift File Integrity Operator bug fix and enhancement update
An updated OpenShift File Integrity Operator image that fixes various bugs and adds new enhancements is now available for the Red Hat OpenShift Enterprise 4 catalog. The OpenShift File Integrity Operator v1.5.0 is now available. See the documentation for bug fix information:...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.21 CNF IBU extras update
An update for ibu components is available for Red Hat OpenShift Container Platform 4.21. Red Hat OpenShift Container Platform is Red Hat's cloud computing Kubernetes application platform solution designed for on-premise or private cloud deployments. This advisory contains the extra ibu container...
Important: Red Hat Security Advisory: dogtag-pki security update
An update for dogtag-pki is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...
pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint)
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...
pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...
kernel: net: tun: bound receive headroom
A flaw was found in the Linux kernel's TUN/TAP driver. An integer underflow vulnerability exists in the tungetuser function when processing oversized headroom requests. This can occur if Open vSwitch OVS propagates an excessively large headroom request to the TUN or TAP device. Successful...
kernel: netfilter: ebtables SNAT target writes to shared memory pages during ARP hardware address rewrite
A flaw was found in the Linux kernel's netfilter bridge ebtables SNAT Source Network Address Translation module. This vulnerability allows a local attacker on a system configured with specific bridge netfilter rules to improperly modify underlying memory pages during an ARP Address Resolution...
kernel: net: ipv6: use-after-free in fib6_rule_suppress due to stale res->rt6 pointer
A use-after-free vulnerability was found in the Linux kernel's IPv6 FIB rule lookup path. In fib6rulesuppress, when a route is suppressed and released via ip6rtputflags, the res-rt6 pointer is not cleared. If no later rule supplies a replacement route, fib6rulelookup returns the stale freed rt6in...
kernel: sctp: prevent peer transport count overflow
A flaw was found in the Stream Control Transmission Protocol SCTP implementation within the Linux kernel. An integer overflow occurs when the transportcount for an association exceeds its 16-bit limit, causing it to wrap around to zero. This allows a diagnostic dump to write 8 MiB of peer address...
Important: Red Hat Security Advisory: kernel security update
An update for kernel is now available for Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
Important: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux for NVIDIA. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerabilit...
kernel: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg
A race condition was found in the Linux kernel cryptographic user API, AFALG in the way concurrent writes to the same AFALG socket are handled. Interleaved data and inconsistent internal socket state may result. A local user could use this flaw to crash the system or corrupt cryptographic operati...
kernel: pppoe: reload header pointer after dev_hard_header()
A flaw was found in the Linux kernel's PPPoE Point-to-Point Protocol over Ethernet implementation. This vulnerability occurs because a pointer to network packet data is not updated after memory is reallocated, leading to the use of an outdated memory address. An attacker with local access could...
pki-core: Dogtag PKI v2 REST ACL filter's reverse-lexicographic tie-break lets a CA Agent invoke the admin-only raw profile creation endpoint
A flaw was found in pki-core. The v2 REST ACL filter selects a tie-breaking permission for colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity, causing a wildcard-mapped permission to override a more specific literal-mapped permission when both...
Important: Red Hat Security Advisory: pki-core security update
An update for pki-core is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from...
pki-core: Dogtag/PKI: certprofile-import allows code execution via unsanitized profile content (ExternalProcessConstraint)
A flaw was found in Dogtag PKI, as used by FreeIPA's certificate authority component. The certificate profile import functionality does not fully validate uploaded profile content beyond the profile ID. An authenticated user with CA Administrator privileges can exploit Dogtag's...
gimp: gimp: Stack buffer overflow in pnmscanner_gettoken()
A flaw was found in GIMP's PNM file format parser. When parsing a specially crafted PNM file, the pnmscannergettoken function writes a null terminator one byte past the end of a stack-allocated buffer due to an off-by-one error in the loop boundary check. This could lead to memory corruption,...
gimp: GIMP: Remote code execution via PSD file parsing integer overflow
A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability within the readchanneldata function during PSD Photoshop Document file parsing by enticing a user to open a specially crafted PSD file. This could lead to arbitrary code execution in the context of the...
gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow
A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the TIF file parsing component allows remote attackers to execute arbitrary code. Successful exploitation requires user interaction, where a target must open a malicious TIF file. An attacker can leverage this to execute...
gimp: GIMP: Arbitrary code execution in PSD plugin due to unsigned underflow
A flaw was found in GIMP's PSD file format plugin. This vulnerability, an unsigned integer underflow in the blockrem variable, occurs when a user opens a specially crafted .psd image file. The underflow leads to parser confusion, enabling an attacker to inject arbitrary data as layer resource...
gimp: GIMP: Arbitrary code execution via crafted TIF file parsing
A flaw was found in GIMP. This vulnerability allows a remote attacker to execute arbitrary code by tricking a user into opening a specially crafted TIF file. The issue arises from improper validation of user-supplied data during TIF file parsing, which can lead to an integer overflow before memor...
gimp: GIMP: Remote code execution via TIF file parsing vulnerability
A flaw was found in GIMP. This vulnerability, a stack-based buffer overflow in the TIF file parsing component, allows a remote attacker to execute arbitrary code. User interaction is required, as the target must open a specially crafted malicious TIF file. The issue stems from insufficient...
gimp: GIMP: Remote Code Execution via TIF file parsing integer overflow
A flaw was found in GIMP, an image manipulation program. This vulnerability allows a remote attacker to execute arbitrary code on an affected system. Exploitation requires user interaction, where the target must open a specially crafted TIF Tagged Image File Format file. The flaw occurs during TI...
Important: Red Hat Security Advisory: gimp security update
An update for gimp is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for ea...
gimp: gimp: Heap buffer overflow in read_channel_data()
A flaw was found in GIMP's Paint Shop Pro PSP file format parser. This heap buffer overflow vulnerability allows a remote attacker to cause arbitrary code execution or a denial of service DoS by tricking a user into opening a specially crafted PSP image file. The vulnerability occurs because the...
gimp: GIMP: Remote Code Execution via SGI File Parsing Integer Overflow
A flaw was found in GIMP. This vulnerability, an integer overflow within the parsing of SGI Silicon Graphics Image files, allows a remote attacker to execute arbitrary code. Exploitation requires user interaction, where the target must open a specially crafted malicious SGI file. Successful...
gimp: GIMP APNG loader heap-buffer-overflow when fcTL width exceeds IHDR width (file-png.c)
A heap-buffer-overflow vulnerability exists in the APNG Animated PNG file loader of GIMP. This flaw occurs when the fcTL width exceeds the IHDR width, leading to pixel data being written past the end of a heap allocation. Additionally, a heap-based buffer overflow exists in the DDS plug-in due to...
gimp: gimp: Integer overflow in read_RLE_channel()
A flaw was found in GIMP's PSD parser. An integer overflow in readRLEchannel can cause an undersized heap allocation for the RLE row-length table, after which subsequent per-row writes corrupt heap memory. This could lead to memory corruption, potentially resulting in denial of service or arbitra...
gimp: integer overflow in file-fits plugin causes a heap-based buffer overflow on crafted FITS images
A flaw was found in the file-fits plugin in GIMP. When processing a FITS image file, the plugin calculates memory allocation sizes using signed 32-bit integers for width and height. If a crafted file sets both values to large values, their product exceeds 2^31 and overflows, resulting in an...
gimp: GIMP: Remote code execution via TIF file parsing heap-based buffer overflow
A flaw was found in GIMP. This heap-based buffer overflow vulnerability in the TIF file parsing component allows a remote attacker to execute arbitrary code. User interaction is required, as the target must open a specially crafted malicious TIF file. Successful exploitation can lead to arbitrary...
netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses 103, followed by a 200 with a GET body, then another 200 for a HEAD request when the client pipelines GET the...
c3p0: c3p0: Arbitrary Code Execution via deserialization of crafted objects
A flaw was found in c3p0, a Java Database Connectivity JDBC Connection pooling library. This vulnerability allows an attacker to achieve arbitrary code execution by providing maliciously crafted Java-serialized objects or javax.naming.Reference instances. By manipulating the userOverridesAsString...
netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both Transfer-Encoding: chunked and Content-Length headers. While Netty correctly strips the conflicting Content-Length header for HTTP/1.1 messages, thi...
Important: Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 7.1.16 security update
A security update is now available for Red Hat JBoss Enterprise Application Platform 7.1 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity...
netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker can exploit this vulnerability by sending a specially crafted LZ4 compressed data stream. This can cause the Lz4FrameDecoder to allocate a large amount of memory up to 32 MB per block before...
netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing
A flaw was found in Netty. This vulnerability allows a remote attacker to perform request smuggling attacks due to incorrect parsing of malformed Transfer-Encoding headers. By exploiting this flaw, an attacker can bypass security controls and potentially access sensitive information or manipulate...
netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected...
com.mchange/mchange-commons-java: mchange-commons-java: Arbitrary code execution via JNDI dereferencing of crafted objects
A flaw was found in mchange-commons-java, a Java utility library. An attacker can exploit this vulnerability by providing a maliciously crafted javax.naming.Reference or serialized object to an application using the library. This can provoke the application to download and execute arbitrary...
Critical: Red Hat Security Advisory: RHOAI 3.3.7 - Red Hat OpenShift AI
Updated images are now available for Red Hat OpenShift AI. Release of RHOAI 3.3.7 provides these changes:...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.0.3 (cuda)
Red Hat AI Base Images 3.0.3 cuda is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.0.3 (spyre)
Red Hat AI Base Images 3.0.3 spyre is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.0.3 (cpu)
Red Hat AI Base Images 3.0.3 cpu is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.0.3 (tpu)
Red Hat AI Base Images 3.0.3 tpu is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: rhc security update
An update for rhc is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests
A flaw was found in gRPC-Go. Servers created with xds.NewGRPCServer can be exploited by a remote client sending a malformed RPC request that lacks the required :authority or Host headers. This can trigger an index-out-of-bounds panic, leading to the termination of the entire server process and a...
Important: Red Hat Security Advisory: OpenShift Container Platform 4.19.49 bug fix and security update
Red Hat OpenShift Container Platform release 4.19.49 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.19. Red Hat Product Security has rated this update as having a...