Enterprise Linux Server Tus (Redhat) - vulnerabilities (CVEs)

769 CVEs, 0 in the last 30 days, 12 known versions, newest CVE from 2026-03-31. Vendor: Redhat.

CVEs of Enterprise Linux Server Tus

CVE-2026-5201 - CVSS 7.5 (high), 2026-03-31: A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color…
CVE-2026-4775 - CVSS 7.8 (high), 2026-03-24: A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by…
CVE-2025-13601 - CVSS 7.7 (high), 2025-11-26: A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to…
CVE-2025-6021 - CVSS 7.5 (high), 2025-06-12: A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This…
CVE-2025-3155 - CVSS 7.4 (high), 2025-04-03: A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to…
CVE-2025-2784 - CVSS 7 (high), 2025-04-03: A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup…
CVE-2024-12085 - CVSS 7.5 (high), 2025-01-14: A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length…
CVE-2024-9675 - CVSS 7.8 (high), 2024-10-09: A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a…
CVE-2023-3758 - CVSS 7.1 (high), 2024-04-18: A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization…
CVE-2024-1488 - CVSS 8 (high), 2024-02-15: A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime…
CVE-2024-1062 - CVSS 5.5 (medium), 2024-02-12: A heap overflow flaw was found in 389-ds-base. This issue leads to a denial of service when writing a value larger than 256 chars in log_entry_attr.
CVE-2023-6535 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-6356 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-6536 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-5455 - CVSS 6.5 (medium), 2024-01-10: A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the…
CVE-2023-5870 - CVSS 4.4 (medium), 2023-12-10: A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum…
CVE-2023-5869 - CVSS 8.8 (high), 2023-12-10: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value…
CVE-2023-5868 - CVSS 4.3 (medium), 2023-12-10: A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function…
CVE-2023-1476 - CVSS 7 (high), 2023-11-03: A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code. This issue occurs due to a race condition between…
CVE-2023-46848 - CVSS 8.6 (high), 2023-11-03: Squid is vulnerable to Denial of Service, where a remote attacker can perform DoS by sending ftp:// URLs in HTTP Request messages or constructing ftp:// URLs…
CVE-2023-46847 - CVSS 8.6 (high), 2023-11-03: Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory…
CVE-2023-46846 - CVSS 9.3 (critical), 2023-11-03: SQUID is vulnerable to HTTP request smuggling, caused by chunked decoder lenience, allows a remote attacker to perform Request/Response smuggling past…
CVE-2023-3972 - CVSS 7.8 (high), 2023-11-01: A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and…
CVE-2023-5633 - CVSS 7.8 (high), 2023-10-23: The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled…
CVE-2023-4911 - CVSS 7.8 (high), 2023-10-03: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow…
CVE-2023-5157 - CVSS 7.5 (high), 2023-09-27: A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service.
CVE-2023-4813 - CVSS 5.9 (medium), 2023-09-12: A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash.…
CVE-2023-3899 - CVSS 7.8 (high), 2023-08-23: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1…
CVE-2023-2295 - CVSS 7.5 (high), 2023-05-17: A vulnerability was found in the libreswan library. This security issue occurs when an IKEv1 Aggressive Mode packet is received with only unacceptable crypto…
CVE-2023-2491 - CVSS 7.8 (high), 2023-05-17: A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result…
CVE-2023-2203 - CVSS 8.8 (high), 2023-05-17: A flaw was found in the WebKitGTK package. An improper input validation issue may lead to a use-after-free vulnerability. This flaw allows attackers with…
CVE-2023-0494 - CVSS 7.8 (high), 2023-03-27: A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and…
CVE-2019-8720 - CVSS 8.8 (high), 2023-03-06: A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved…
CVE-2022-4254 - CVSS 8.8 (high), 2023-02-01: sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
CVE-2022-2601 - CVSS 8.6 (high), 2022-12-14: A buffer overflow was found in grub_font_construct_glyph(). A malicious crafted pf2 font can lead to an overflow when calculating the max_glyph_size value,…
CVE-2014-0148 - CVSS 5.5 (medium), 2022-09-29: Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing…
CVE-2014-0147 - CVSS 6.2 (medium), 2022-09-29: Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by…
CVE-2014-0144 - CVSS 8.6 (high), 2022-09-29: QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer…
CVE-2021-3669 - CVSS 5.5 (medium), 2022-08-26: A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource…
CVE-2021-3975 - CVSS 6.5 (medium), 2022-08-23: A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being…
CVE-2021-23177 - CVSS 7.8 (high), 2022-08-23: An improper link resolution flaw while extracting an archive can lead to changing the access control list (ACL) of the target of the link. An attacker may…
CVE-2021-31566 - CVSS 7.8 (high), 2022-08-23: An improper link resolution flaw can occur while extracting an archive leading to changing modes, times, access control lists, and flags of a file outside of…
CVE-2021-3659 - CVSS 5.5 (medium), 2022-08-22: A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection.…
CVE-2021-3696 - CVSS 4.5 (medium), 2022-07-06: A heap out-of-bounds write may heppen during the handling of Huffman tables in the PNG reader. This may lead to data corruption in the heap space.…
CVE-2021-3695 - CVSS 4.5 (medium), 2022-07-06: A crafted 16-bit grayscale PNG image may lead to a out-of-bounds write in the heap area. An attacker may take advantage of that to cause heap data corruption…
CVE-2021-3697 - CVSS 7 (high), 2022-07-06: A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap. To a successful to be…
CVE-2022-1227 - CVSS 8.8 (high), 2022-04-29: A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded…
CVE-2022-27649 - CVSS 7.5 (high), 2022-04-04: A flaw was found in Podman, where containers were started incorrectly with non-empty default permissions. A vulnerability was found in Moby (Docker Engine),…
CVE-2022-0435 - CVSS 8.8 (high), 2022-03-25: A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of…
CVE-2022-0330 - CVSS 7.8 (high), 2022-03-25: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This…
CVE-2022-1011 - CVSS 7.8 (high), 2022-03-18: A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized…
CVE-2022-0847 - CVSS 7.8 (high), 2022-03-10: A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe…
CVE-2022-0516 - CVSS 7.8 (high), 2022-03-10: A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local…
CVE-2021-3733 - CVSS 6.5 (medium), 2022-03-10: There's a flaw in urllib's AbstractBasicAuthHandler class. An attacker who controls a malicious HTTP server that an HTTP client (such as web browser) connects…
CVE-2021-3656 - CVSS 8.8 (high), 2022-03-04: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block)…
CVE-2021-3744 - CVSS 5.5 (medium), 2022-03-04: A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a…
CVE-2021-3609 - CVSS 7 (high), 2022-03-03: .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory,…
CVE-2022-0492 - CVSS 7.8 (high), 2022-03-03: A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances,…
CVE-2021-44142 - CVSS 8.8 (high), 2022-02-21: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a…
CVE-2020-25717 - CVSS 8.1 (high), 2022-02-18: A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
CVE-2016-2124 - CVSS 5.9 (medium), 2022-02-18: A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even…
CVE-2020-25719 - CVSS 7.2 (high), 2022-02-18: A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become…
CVE-2021-3551 - CVSS 7.8 (high), 2022-02-16: A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw…
CVE-2021-4034 - CVSS 7.8 (high), 2022-01-28: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users…
CVE-2021-3621 - CVSS 8.8 (high), 2021-12-23: A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows…
CVE-2021-3672 - CVSS 5.6 (medium), 2021-11-23: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong…
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-20233 - CVSS 8.2 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that…
CVE-2020-14372 - CVSS 7.5 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows…
CVE-2020-27749 - CVSS 6.7 (medium), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable…
CVE-2020-25647 - CVSS 7.6 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the…
CVE-2021-20225 - CVSS 6.7 (medium), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain…
CVE-2020-25632 - CVSS 8.2 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any…
CVE-2020-27779 - CVSS 7.5 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address…
CVE-2020-9490 - CVSS 7.5 (high), 2020-08-07: Apache HTTP Server versions 2.4.20 to 2.4.43. A specially crafted value for the 'Cache-Digest' header in a HTTP/2 request would result in a crash when the…
CVE-2020-14310 - CVSS 6 (medium), 2020-07-31: There is an issue on grub2 before version 2.06 at function read_section_as_string(). It expects a font name to be at max UINT32_MAX - 1 length in bytes but it…
CVE-2020-14311 - CVSS 6 (medium), 2020-07-31: There is an issue with grub2 before version 2.06 while handling symlink on ext filesystems. A filesystem containing a symbolic link with an inode size of…
CVE-2020-10711 - CVSS 5.9 (medium), 2020-05-22: A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP…
CVE-2013-4535 - CVSS 8.8 (high), 2020-02-11: The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image,…
CVE-2019-15605 - CVSS 9.8 (critical), 2020-02-07: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVE-2019-15604 - CVSS 7.5 (high), 2020-02-07: Improper Certificate Validation in Node.js 10, 12, and 13 causes the process to abort when sending a crafted X.509 certificate
CVE-2014-8141 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…
CVE-2014-8140 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…
CVE-2014-8139 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…
CVE-2020-2659 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and…
CVE-2020-2654 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and…
CVE-2020-2604 - CVSS 8.1 (high), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2601 - CVSS 6.8 (medium), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2583 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2593 - CVSS 4.8 (medium), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241,…
CVE-2015-3147 - CVSS 6.5 (medium), 2020-01-14: daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to…
CVE-2014-7844 - CVSS 7.8 (high), 2020-01-14: BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
CVE-2020-6851 - CVSS 7.5 (high), 2020-01-13: OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions…
CVE-2019-17017 - CVSS 8.8 (high), 2020-01-08: Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it…
CVE-2019-17016 - CVSS 6.1 (medium), 2020-01-08: When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for…
CVE-2019-17024 - CVSS 8.8 (high), 2020-01-08: Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we…
CVE-2019-17022 - CVSS 6.1 (medium), 2020-01-08: When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting…
CVE-2019-19906 - CVSS 7.5 (high), 2019-12-19: cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The…
CVE-2018-1311 - CVSS 8.1 (high), 2019-12-18: The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed…
CVE-2019-13734 - CVSS 8.8 (high), 2019-12-10: Out of bounds write in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.