Enterprise Linux Server Aus (Redhat) - vulnerabilities (CVEs)

1061 CVEs, 0 in the last 30 days, 20 known versions, newest CVE from 2026-03-31. Vendor: Redhat.

CVEs of Enterprise Linux Server Aus

CVE-2026-5201 - CVSS 7.5 (high), 2026-03-31: A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color…
CVE-2026-4775 - CVSS 7.8 (high), 2026-03-24: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by…
CVE-2026-4424 - CVSS 7.5 (high), 2026-03-19: A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS…
CVE-2025-13601 - CVSS 7.7 (high), 2025-11-26: A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to…
CVE-2025-6021 - CVSS 7.5 (high), 2025-06-12: A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This…
CVE-2025-3155 - CVSS 7.4 (high), 2025-04-03: A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to…
CVE-2025-2784 - CVSS 7 (high), 2025-04-03: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup…
CVE-2025-1756 - CVSS 7.8 (high), 2025-02-27: mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated…
CVE-2024-12088 - CVSS 7.5 (high), 2025-01-14: A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server…
CVE-2024-12087 - CVSS 7.5 (high), 2025-01-14: A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client…
CVE-2024-12085 - CVSS 7.5 (high), 2025-01-14: A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length…
CVE-2024-9676 - CVSS 6.5 (medium), 2024-10-15: A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and…
CVE-2024-9675 - CVSS 7.8 (high), 2024-10-09: A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a…
CVE-2024-7006 - CVSS 7.5 (high), 2024-08-12: A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through…
CVE-2024-6387 - CVSS 8.1 (high), 2024-07-01: A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an…
CVE-2023-3758 - CVSS 7.1 (high), 2024-04-18: A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization…
CVE-2022-24809 - CVSS 6.5 (medium), 2024-04-16: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a…
CVE-2022-24807 - CVSS 6.5 (medium), 2024-04-16: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to…
CVE-2022-24806 - CVSS 6.5 (medium), 2024-04-16: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an…
CVE-2022-24808 - CVSS 6.5 (medium), 2024-04-16: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a…
CVE-2022-24805 - CVSS 8.8 (high), 2024-04-16: net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX`…
CVE-2024-1488 - CVSS 8 (high), 2024-02-15: A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime…
CVE-2024-1062 - CVSS 5.5 (medium), 2024-02-12: A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
CVE-2023-6535 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-6356 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-6536 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-5992 - CVSS 5.9 (medium), 2024-01-31: A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the…
CVE-2023-6915 - CVSS 6.2 (medium), 2024-01-15: A Null pointer dereference problem was found in ida_free in lib/idr.c in the Linux Kernel. This issue may allow an attacker using this library to cause a…
CVE-2023-5455 - CVSS 6.5 (medium), 2024-01-10: A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the…
CVE-2024-0193 - CVSS 7.8 (high), 2024-01-02: A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed,…
CVE-2023-5869 - CVSS 8.8 (high), 2023-12-10: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value…
CVE-2023-5868 - CVSS 4.3 (medium), 2023-12-10: A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function…
CVE-2023-5870 - CVSS 4.4 (medium), 2023-12-10: A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum…
CVE-2023-6606 - CVSS 7.1 (high), 2023-12-08: An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash…
CVE-2023-46848 - CVSS 8.6 (high), 2023-11-03: Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs…
CVE-2023-46847 - CVSS 8.6 (high), 2023-11-03: Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory…
CVE-2023-46846 - CVSS 9.3 (critical), 2023-11-03: SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past…
CVE-2023-3972 - CVSS 7.8 (high), 2023-11-01: A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and…
CVE-2023-5633 - CVSS 7.8 (high), 2023-10-23: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled…
CVE-2023-4911 - CVSS 7.8 (high), 2023-10-03: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow…
CVE-2023-5157 - CVSS 7.5 (high), 2023-09-27: A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.
CVE-2023-4806 - CVSS 5.9 (medium), 2023-09-18: A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an…
CVE-2023-4527 - CVSS 6.5 (medium), 2023-09-18: A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via…
CVE-2023-4813 - CVSS 5.9 (medium), 2023-09-12: A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash.…
CVE-2023-38201 - CVSS 6.5 (medium), 2023-08-25: A flaw was found in the Keylime registrar that could allow a bypass of the challenge-response protocol during agent registration. This issue may allow an…
CVE-2023-3899 - CVSS 7.8 (high), 2023-08-23: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1…
CVE-2023-4147 - CVSS 7.8 (high), 2023-08-07: A use-after-free flaw was found in the Linux kernel’s Netfilter functionality when adding a rule with NFTA_RULE_CHAIN_ID. This flaw allows a local user to…
CVE-2023-38200 - CVSS 7.5 (high), 2023-07-24: A flaw was found in Keylime. Due to their blocking nature, the Keylime registrar is subject to a remote denial of service against its SSL connections. This…
CVE-2023-2295 - CVSS 7.5 (high), 2023-05-17: A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto…
CVE-2023-2203 - CVSS 8.8 (high), 2023-05-17: A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with…
CVE-2023-2491 - CVSS 7.8 (high), 2023-05-17: A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result…
CVE-2023-0494 - CVSS 7.8 (high), 2023-03-27: A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and…
CVE-2019-8720 - CVSS 8.8 (high), 2023-03-06: A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved…
CVE-2022-4254 - CVSS 8.8 (high), 2023-02-01: sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
CVE-2022-2601 - CVSS 8.6 (high), 2022-12-14: A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value,…
CVE-2014-0147 - CVSS 6.2 (medium), 2022-09-29: Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by…
CVE-2014-0144 - CVSS 8.6 (high), 2022-09-29: QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer…
CVE-2014-0148 - CVSS 5.5 (medium), 2022-09-29: Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing…
CVE-2021-3669 - CVSS 5.5 (medium), 2022-08-26: A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource…
CVE-2021-23177 - CVSS 7.8 (high), 2022-08-23: An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may…
CVE-2021-31566 - CVSS 7.8 (high), 2022-08-23: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of…
CVE-2021-3659 - CVSS 5.5 (medium), 2022-08-22: A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection.…
CVE-2021-3696 - CVSS 4.5 (medium), 2022-07-06: A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space.…
CVE-2021-3695 - CVSS 4.5 (medium), 2022-07-06: A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption…
CVE-2021-3697 - CVSS 7 (high), 2022-07-06: A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be…
CVE-2022-1227 - CVSS 8.8 (high), 2022-04-29: A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded…
CVE-2022-27649 - CVSS 7.5 (high), 2022-04-04: A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine),…
CVE-2022-0435 - CVSS 8.8 (high), 2022-03-25: A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of…
CVE-2022-0330 - CVSS 7.8 (high), 2022-03-25: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This…
CVE-2022-1011 - CVSS 7.8 (high), 2022-03-18: A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized…
CVE-2022-0847 - CVSS 7.8 (high), 2022-03-10: A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe…
CVE-2022-0516 - CVSS 7.8 (high), 2022-03-10: A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local…
CVE-2021-3733 - CVSS 6.5 (medium), 2022-03-10: There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects…
CVE-2021-3656 - CVSS 8.8 (high), 2022-03-04: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block)…
CVE-2022-0492 - CVSS 7.8 (high), 2022-03-03: A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances,…
CVE-2021-3609 - CVSS 7 (high), 2022-03-03: .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory,…
CVE-2021-44142 - CVSS 8.8 (high), 2022-02-21: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a…
CVE-2016-2124 - CVSS 5.9 (medium), 2022-02-18: A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even…
CVE-2020-25719 - CVSS 7.2 (high), 2022-02-18: A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become…
CVE-2020-25717 - CVSS 8.1 (high), 2022-02-18: A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
CVE-2021-3551 - CVSS 7.8 (high), 2022-02-16: A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw…
CVE-2021-4034 - CVSS 7.8 (high), 2022-01-28: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users…
CVE-2021-3621 - CVSS 8.8 (high), 2021-12-23: A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows…
CVE-2021-3672 - CVSS 5.6 (medium), 2021-11-23: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong…
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2020-14301 - CVSS 6.5 (medium), 2021-05-27: An information disclosure vulnerability was found in libvirt in versions before 6.3.0. HTTP cookies used to access network-based disks were saved in the XML…
CVE-2021-20233 - CVSS 8.2 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that…
CVE-2020-27779 - CVSS 7.5 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address…
CVE-2020-14372 - CVSS 7.5 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows…
CVE-2020-27749 - CVSS 6.7 (medium), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable…
CVE-2020-25647 - CVSS 7.6 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the…
CVE-2021-20225 - CVSS 6.7 (medium), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain…
CVE-2020-25632 - CVSS 8.2 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any…
CVE-2020-9490 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the…
CVE-2020-14310 - CVSS 6 (medium), 2020-07-31: There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it…
CVE-2020-14311 - CVSS 6 (medium), 2020-07-31: There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of…
CVE-2019-15605 - CVSS 9.8 (critical), 2020-02-07: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVE-2019-15604 - CVSS 7.5 (high), 2020-02-07: Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
CVE-2014-8140 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…
CVE-2014-8139 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…