145300 matches found
kernel: nvme-tcp: fix host memory disclosure on R2T for a read command
A flaw was found in the Linux kernel's NVMe Non-Volatile Memory Express over TCP nvme-tcp component. A malicious NVMe controller can exploit this vulnerability by sending a Ready to Transfer R2T command for a read request. The host system, failing to properly validate the request direction, will...
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable
A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksu...
kernel: scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer
A flaw was found in the Linux kernel's libiscsitcp component. A remote attacker, acting as a malicious iSCSI target, could send a specially crafted iSCSI SCSI Command Response ISCSIOPSCSICMDRSP with an oversized data segment. This could lead to a buffer overflow in a fixed-size buffer, potentiall...
kernel: dm cache policy smq: fix missing locks in invalidating cache blocks
A flaw was found in the Linux kernel's device-mapper dm cache policy, specifically within the smq module. In passthrough mode, the invalidatemapping operation lacks proper locking, allowing for concurrent access. This can lead to data races, resulting in data corruption or use-after-free issues,...
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...
kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...
Critical: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
kernel: procfs: fix missing RCU protection when reading real_parent in do_task_stat()
A flaw was found in the Linux kernel's procfs component. When reading /proc/pid/stat, the dotaskstat function accesses task-realparent without proper Read-Copy-Update RCU protection. This missing protection creates a race condition, which can lead to a Use-After-Free UAF vulnerability. A local...
pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance
A flaw was found in pyjwt. A remote attacker can forge authentication tokens and bypass security controls by signing tokens with an empty key. When verifying tokens against a JSON Web Key JWK set that contains an empty Hash-based Message Authentication Code HMAC key, the library fails to enforce...
pyjwt: PyJWT: Authentication bypass via improper public key validation
A flaw was found in PyJWT. When an application allows both symmetric and asymmetric signing algorithms, minor formatting variations in a public key can prevent the library from properly identifying it as an asymmetric key. Consequently, the library improperly treats the public key as a shared...
pyjwt: PyJWT: Authentication bypass via acceptance of DER public keys as HMAC secrets
A flaw was found in PyJWT. The library fails to identify asymmetric public keys supplied in Distinguished Encoding Rules DER format, inadvertently treating the public data as a shared secret in Hash-based Message Authentication Code HMAC operations. If an application supports both asymmetric and...
pyjwt: pyjwt: Token forgery via improper Unicode byte-order mark handling
A flaw was found in pyjwt. When verifying cryptographic keys, the raw JSON Web Key JWK parser fails to normalize Unicode byte-order marks BOM. In mixed-algorithm verification environments, an attacker who knows the public key can supply a key prefixed with a byte-order mark, causing the system to...
pyjwt: pyjwt: Verification key substitution via unvalidated JWKS redirects
A flaw was found in PyJWT. When retrieving cryptographic keys from a JSON Web Key Set JWKS endpoint, PyJWKClient fails to validate HTTP redirect destinations against trusted domain boundaries. A remote attacker who can influence the response of a trusted endpoint can redirect key requests to an...
Critical: Red Hat Security Advisory: fence-agents security update
An update for fence-agents is now available for Red Hat Enterprise Linux 10.2 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is availabl...
thrift: github.com/apache/thrift: Apache Thrift: Denial of Service via integer overflow or wraparound
A flaw was found in Apache Thrift's C++, cglib, Go, netstd, Delphi, and Haxe bindings. This integer overflow or wraparound vulnerability allows a remote attacker to cause a denial of service DoS by sending specially crafted input. The flaw can lead to the affected service becoming unavailable...
Important: Red Hat Security Advisory: RHEL AI 3.4 RPM runtime CVE fix - thrift
Security scans report the following CVEs, all of which have IMPORTANT impact: - CVE-2026-43871 - CVE-2026-55969 RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red Hat AI application platform...
thrift: Apache Thrift: Denial of Service via infinite loop
A flaw was found in Apache Thrift, affecting its Python, Go, PHP, and Java components. This vulnerability, known as an 'Infinite Loop', could allow a remote attacker to disrupt service availability. By exploiting this flaw, an attacker can trigger a continuous loop, leading to a denial of service...
Important: Red Hat Security Advisory: libXtst security update
An update for libXtst is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...
libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
A flaw was found in libXtst. An out-of-bounds read vulnerability in the RECORD extension reply parser allows a malicious X server to cause a Denial of Service DoS by crashing connected client applications. Under certain conditions, this flaw may also result in limited information disclosure...
Moderate: Red Hat Security Advisory: pipewire security update
An update for pipewire is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...
pipewire: Pulse Server alloca Stack Overflow
Multiple unbounded alloca calls in the PulseAudio protocol server...
ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in DASH demuxer
A flaw was found in FFmpeg. A malicious or misconfigured DASH Dynamic Adaptive Streaming over HTTP server can exploit an out-of-bounds read vulnerability in the DASH demuxer. This occurs when a live DASH manifest is refreshed with a startNumber that is lower than the previous value, causing a...
ffmpeg: FFmpeg: Information disclosure and denial of service via out-of-bounds read in S/PDIF muxer
A flaw was found in FFmpeg, specifically within the S/PDIF muxer. A remote attacker can exploit an out-of-bounds read vulnerability by providing a specially crafted DTS-HD audio stream during S/PDIF re-muxing. This allows the attacker to read memory beyond the intended buffer boundaries,...
Important: Red Hat Security Advisory: RHEL AI 3.5 RPM runtime CVE fix - ffmpeg
Security scans report the following CVEs, all of which have IMPORTANT impact: - CVE-2026-64832 - CVE-2026-64833 - CVE-2026-70628 - CVE-2026-75142 - CVE-2026-75144 - CVE-2026-75146 RPM packages are internal build artifacts and not supported on their own. They are only supported as part of the Red...
ffmpeg: FFmpeg: Stack Buffer Overflow in MPEG-PS Muxer
A flaw was found in FFmpeg. A stack buffer overflow exists in the MPEG-PS muxer. A local attacker or a user processing a specially crafted file with an excessive number of streams could trigger this flaw, leading to a buffer overflow. This could potentially result in denial of service or arbitrar...
ffmpeg: FFmpeg: Arbitrary code execution via crafted WTV file in DVB subtitle parser
A flaw was found in FFmpeg. An attacker could exploit a signed integer overflow vulnerability within the DVB subtitle parser by providing a specially crafted WTV Windows Recorded TV Show file. This overflow can lead to a heap buffer overflow, enabling out-of-bounds memory writes. The consequence ...
ffmpeg: FFmpeg: Arbitrary code execution via crafted video file in NVDEC hardware decoder
A flaw was found in FFmpeg, specifically within the NVIDIA NVDEC hardware decoder. A remote attacker could exploit this double-free vulnerability by providing a specially crafted video file. This can lead to memory corruption, potentially allowing for arbitrary code execution or causing a denial ...
ffmpeg: FFmpeg: Memory corruption via crafted Dirac data unit
A flaw was found in FFmpeg. Attackers can trigger memory corruption in the VC-2/Dirac RTP packetizer by supplying a specially crafted Dirac data unit. This heap buffer overflow occurs because the packetizer copies input data into a fixed-size buffer without proper size validation. This can lead t...
Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection - 1.4.12
A new version of OpenShift API for Data Protection OADP 1.4.12 is now available. OpenShift API for Data Protection OADP 1.4.12 enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file...
Important: Red Hat Security Advisory: LVMS 4.18 Bug Fix and Enhancement update
Updated container images that fix multiple bugs are now available for LVMS 4.18 After a successful LVMS upgrade, the latest lvms-operator SHA image should be running. This erratum implements the following changes: - Bump go version to address CVE-2026-56860, CVE-2026-56859, CVE-2026-56858,...
kernel: HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq
A flaw was found in the Linux kernel's Wacom Human Interface Device HID driver. This vulnerability allows a remote attacker to trigger an out-of-bounds read by sending a specially crafted, short Bluetooth HID report. This can lead to the disclosure of sensitive information from the system's memor...
Critical: Red Hat Security Advisory: kernel security, bug fix, and enhancement update
An update for kernel is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Critical. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for...
kernel: net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change
In the Linux kernel, the following vulnerability has been resolved: net/sched: ets: Always remove class from active list before deleting in etsqdiscchange [email protected] says: The vulnerability is a race condition between etsqdiscdequeue and etsqdiscchange. It leads to UAF on stru...
kernel: pfifo_tail_enqueue: Drop new packet when sch->limit == 0
In the Linux kernel, the following vulnerability has been resolved: pfifotailenqueue: Drop new packet when sch-limit == 0 Expected behaviour: In case we reach scheduler's limit, pfifotailenqueue will drop a packet in scheduler's queue and decrease scheduler's qlen by one. Then, pfifotailenqueue...
kernel: Bluetooth: hci_ldisc: Clear HCI_UART_PROTO_INIT on error
A flaw was found in the Linux kernel's Bluetooth Host Controller Interface HCI Universal Asynchronous Receiver/Transmitter UART driver. When the hciregisterdev function fails, a flag indicating protocol initialization is not properly cleared. This oversight allows incoming UART data to be process...
kernel: sctp: validate embedded INIT chunk and address list lengths in cookie
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. Specifically, improper validation of embedded INIT chunk and address list lengths in SCTP cookies could allow a remote attacker to trigger out-of-bounds reads. This could lead to information disclosur...
kernel: ipv4: free inet_opt and ireq_opt after an RCU grace period
A flaw was found in the Linux kernel's IPv4 networking subsystem. A race condition occurs during concurrent processing of retransmitted Transmission Control Protocol TCP connection requests or socket migrations, allowing socket options to be freed while still in use. A remote attacker could explo...
kernel: sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
A flaw was found in the Linux kernel's Stream Control Transmission Protocol SCTP implementation. A remote attacker could exploit this by sending a specially crafted COOKIEECHO chunk to a listening SCTP server. The server's failure to properly validate the length of a cached peer INIT chunk within...
kernel: net: bridge: use a stable FDB dst snapshot in RCU readers
A flaw was found in the Linux kernel. Inconsistent handling of local Forwarding Database FDB entries in the bridge networking component's RCU Read-Copy-Update readers can lead to a null-pointer dereference. A local attacker could exploit this by triggering a concurrent update to an FDB entry,...
Important: Red Hat Security Advisory: libXtst security update
An update for libXtst is now available for Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerabili...
libXtst: libXtst: Denial of Service via out-of-bounds read in RECORD reply parser
A flaw was found in libXtst. An out-of-bounds read vulnerability in the RECORD extension reply parser allows a malicious X server to cause a Denial of Service DoS by crashing connected client applications. Under certain conditions, this flaw may also result in limited information disclosure...
Critical: Red Hat Security Advisory: Red Hat AI Base Images 3.0.8 (CUDA)
Red Hat AI Base Images 3.0.8 CUDA is now available. Red Hat® AI Base Images...
Critical: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 12.9)
Red Hat AI Base Images 3.5.6 CUDA 12.9 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (Spyre)
Red Hat AI Base Images 3.5.6 Spyre is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (ROCm 7.1)
Red Hat AI Base Images 3.4.7 ROCm 7.1 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (ROCm 7.14)
Red Hat AI Base Images 3.5.6 ROCm 7.14 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.5.6 (CUDA 13.0)
Red Hat AI Base Images 3.5.6 CUDA 13.0 is now available. Red Hat® AI Base Images...
Important: Red Hat Security Advisory: Red Hat AI Base Images 3.4.7 (CUDA 12.9)
Red Hat AI Base Images 3.4.7 CUDA 12.9 is now available. Red Hat® AI Base Images...