Virtualization Host (Redhat) - vulnerabilities (CVEs)

84 CVEs, 0 in the last 30 days, 1 known versions, newest CVE from 2024-04-18. Vendor: Redhat.

CVEs of Virtualization Host

CVE-2023-3758 - CVSS 7.1 (high), 2024-04-18: A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization…
CVE-2023-6535 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-6356 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-6536 - CVSS 7.5 (high), 2024-02-07: A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using…
CVE-2023-4911 - CVSS 7.8 (high), 2023-10-03: A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow…
CVE-2022-0207 - CVSS 4.7 (medium), 2022-08-26: A race condition was found in vdsm. Functionality to obfuscate sensitive values in log files that may lead to values being stored in clear text.
CVE-2021-3669 - CVSS 5.5 (medium), 2022-08-26: A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource…
CVE-2021-20316 - CVSS 6.8 (medium), 2022-08-23: A flaw was found in the way Samba handled file/directory metadata. This flaw allows an authenticated attacker with permissions to read or modify share…
CVE-2021-3659 - CVSS 5.5 (medium), 2022-08-22: A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection.…
CVE-2022-0435 - CVSS 8.8 (high), 2022-03-25: A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of…
CVE-2022-0330 - CVSS 7.8 (high), 2022-03-25: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This…
CVE-2022-1011 - CVSS 7.8 (high), 2022-03-18: A use-after-free flaw was found in the Linux kernel’s FUSE filesystem in the way a user triggers write(). This flaw allows a local user to gain unauthorized…
CVE-2022-0847 - CVSS 7.8 (high), 2022-03-10: A flaw was found in the way the "flags" member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe…
CVE-2022-0516 - CVSS 7.8 (high), 2022-03-10: A vulnerability was found in kvm_s390_guest_sida_op in the arch/s390/kvm/kvm-s390.c function in KVM for s390 in the Linux kernel. This flaw allows a local…
CVE-2021-3656 - CVSS 8.8 (high), 2022-03-04: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block)…
CVE-2021-3744 - CVSS 5.5 (medium), 2022-03-04: A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a…
CVE-2021-3609 - CVSS 7 (high), 2022-03-03: .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory,…
CVE-2022-0492 - CVSS 7.8 (high), 2022-03-03: A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances,…
CVE-2021-3620 - CVSS 5.5 (medium), 2022-03-03: A flaw was found in Ansible Engine's ansible-connection module, where sensitive information such as the Ansible user credentials is disclosed by default in…
CVE-2021-44142 - CVSS 8.8 (high), 2022-02-21: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a…
CVE-2016-2124 - CVSS 5.9 (medium), 2022-02-18: A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even…
CVE-2020-25717 - CVSS 8.1 (high), 2022-02-18: A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
CVE-2021-3752 - CVSS 7.1 (high), 2022-02-16: A use-after-free flaw was found in the Linux kernel’s Bluetooth subsystem in the way user calls connect to the socket and disconnect simultaneously due to a…
CVE-2021-3560 - CVSS 7.8 (high), 2022-02-16: It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user.…
CVE-2021-45417 - CVSS 7.8 (high), 2022-01-20: AIDE before 0.17.4 allows local users to obtain root privileges via crafted file metadata (such as XFS extended attributes or tmpfs ACLs), because of a…
CVE-2021-3621 - CVSS 8.8 (high), 2021-12-23: A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs-fetch and cache-expire subcommands. This flaw allows…
CVE-2021-3501 - CVSS 7.1 (high), 2021-05-06: A flaw was found in the Linux kernel in versions before 5.12. The value of internal.ndata, in the KVM API, is mapped to an array index, which can be updated…
CVE-2020-10711 - CVSS 5.9 (medium), 2020-05-22: A NULL pointer dereference flaw was found in the Linux kernel's SELinux subsystem in versions before 5.7. This flaw occurs while importing the Commercial IP…
CVE-2019-14821 - CVSS 8.8 (high), 2019-09-19: An out-of-bounds access issue was found in the Linux kernel, all versions through 5.3, in the way Linux kernel's KVM hypervisor implements the Coalesced MMIO…
CVE-2019-14835 - CVSS 7.8 (high), 2019-09-17: A buffer overflow flaw was found, in versions from 2.6.34 to 5.2.x, in the way Linux kernel's vhost functionality that translates virtqueue buffers to IOVs,…
CVE-2019-1125 - CVSS 5.6 (medium), 2019-09-03: An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory. An attacker who successfully exploited…
CVE-2019-10161 - CVSS 8.8 (high), 2019-07-30: It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an…
CVE-2019-11479 - CVSS 7.5 (high), 2019-06-19: Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. This allows a remote peer to fragment TCP resend queues significantly…
CVE-2019-3888 - CVSS 9.8 (critical), 2019-06-12: A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because…
CVE-2019-3460 - CVSS 6.5 (medium), 2019-04-11: A heap data infoleak in multiple locations including L2CAP_PARSE_CONF_RSP was found in the Linux kernel before 5.1-rc1.
CVE-2019-1559 - CVSS 5.9 (medium), 2019-02-27: If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL…
CVE-2018-16881 - CVSS 7.5 (high), 2019-01-25: A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which…
CVE-2018-18397 - CVSS 5.5 (medium), 2018-12-12: The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local…
CVE-2018-14660 - CVSS 6.5 (medium), 2018-11-01: A flaw was found in glusterfs server through versions 4.1.4 and 3.1.2 which allowed repeated usage of GF_META_LOCK_KEY xattr. A remote, authenticated attacker…
CVE-2018-14661 - CVSS 6.5 (medium), 2018-10-31: It was found that usage of snprintf function in feature/locks translator of glusterfs server 3.8.4, as shipped with Red Hat Gluster Storage, was vulnerable to…
CVE-2018-14654 - CVSS 6.5 (medium), 2018-10-31: The Gluster file system through version 4.1.4 is vulnerable to abuse of the 'features/index' translator. A remote attacker with access to mount volumes could…
CVE-2018-14659 - CVSS 6.5 (medium), 2018-10-31: The Gluster file system through versions 4.1.4 and 3.1.2 is vulnerable to a denial of service attack via use of the 'GF_XATTR_IOSTATS_DUMP_KEY' xattr. A…
CVE-2018-18559 - CVSS 8.1 (high), 2018-10-22: In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket. This…
CVE-2018-1000805 - CVSS 8.8 (high), 2018-10-08: Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE.…
CVE-2018-1114 - CVSS 6.5 (medium), 2018-09-11: It was found that URLResource.getLastModified() in Undertow closes the file descriptors only when they are finalized which can cause file descriptors to…
CVE-2018-10930 - CVSS 6.5 (medium), 2018-09-04: A flaw was found in RPC request using gfs3_rename_req in glusterfs server. An authenticated attacker could use this flaw to write to a destination outside the…
CVE-2018-10929 - CVSS 8.8 (high), 2018-09-04: A flaw was found in RPC request using gfs2_create_req in glusterfs server. An authenticated attacker could use this flaw to create arbitrary files and execute…
CVE-2018-10928 - CVSS 8.8 (high), 2018-09-04: A flaw was found in RPC request using gfs3_symlink_req in glusterfs server which allows symlink destinations to point to file paths outside of the gluster…
CVE-2018-10927 - CVSS 8.1 (high), 2018-09-04: A flaw was found in RPC request using gfs3_lookup_req in glusterfs server. An authenticated attacker could use this flaw to leak information and execute…
CVE-2018-10926 - CVSS 8.8 (high), 2018-09-04: A flaw was found in RPC request using gfs3_mknod_req supported by glusterfs server. An authenticated attacker could use this flaw to write files to an…
CVE-2018-10911 - CVSS 7.5 (high), 2018-09-04: A flaw was found in the way dic_unserialize function of glusterfs does not handle negative key length values. An attacker could use this flaw to read memory…
CVE-2018-10923 - CVSS 8.1 (high), 2018-09-04: It was found that the "mknod" call derived from mknod(2) can create files pointing to devices on a glusterfs server node. An authenticated attacker could use…
CVE-2018-10914 - CVSS 6.5 (medium), 2018-09-04: It was found that an attacker could issue a xattr request via glusterfs FUSE to cause gluster brick process to crash which will result in a remote denial of…
CVE-2018-10913 - CVSS 6.5 (medium), 2018-09-04: An information disclosure vulnerability was discovered in glusterfs server. An attacker could issue a xattr request via glusterfs FUSE to determine the…
CVE-2018-10907 - CVSS 8.8 (high), 2018-09-04: It was found that glusterfs server is vulnerable to multiple stack based buffer overflows due to functions in server-rpc-fopc.c allocating fixed size buffers…
CVE-2018-10904 - CVSS 8.8 (high), 2018-09-04: It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the…
CVE-2018-10858 - CVSS 8.8 (high), 2018-08-22: A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw…
CVE-2018-10873 - CVSS 8.8 (high), 2018-08-17: A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks. A…
CVE-2018-10875 - CVSS 7.8 (high), 2018-07-13: A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under…
CVE-2018-10874 - CVSS 7.8 (high), 2018-07-02: In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control,…
CVE-2018-1120 - CVSS 5.3 (medium), 2018-06-20: A flaw was found affecting the Linux kernel before version 4.17. By mmap()ing a FUSE-backed file onto a process's memory containing command line arguments (or…
CVE-2018-1073 - CVSS 5.3 (medium), 2018-06-19: The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and invalid passwords, allowing an attacker…
CVE-2018-5848 - CVSS 7.8 (high), 2018-06-12: In the function wmi_set_ie(), the length validation code does not handle unsigned integer overflow properly. As a result, a large value of the 'ie_len'…
CVE-2018-5803 - CVSS 5.5 (medium), 2018-06-12: In the Linux Kernel before version 4.15.8, 4.14.25, 4.9.87, 4.4.121, 4.1.51, and 3.2.102, an error in the "_sctp_make_chunk()" function…
CVE-2018-1067 - CVSS 6.1 (medium), 2018-05-21: In Undertow before versions 7.1.2.CR1, 7.1.2.GA it was found that the fix for CVE-2016-4993 was incomplete and Undertow web server is vulnerable to the…
CVE-2018-11236 - CVSS 9.8 (critical), 2018-05-18: stdlib/canonicalize.c in the GNU C Library (aka glibc or libc6) 2.27 and earlier, when processing very long pathname arguments to the realpath function, could…
CVE-2018-11237 - CVSS 7.8 (high), 2018-05-18: An AVX-512-optimized implementation of the mempcpy function in the GNU C Library (aka glibc or libc6) 2.27 and earlier may write data beyond the target…
CVE-2018-1118 - CVSS 5.5 (medium), 2018-05-10: Linux kernel vhost since version 4.8 does not properly initialize memory in messages passed between virtual guests and the host operating system in the…
CVE-2018-10675 - CVSS 7.8 (high), 2018-05-02: The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly…
CVE-2018-10237 - CVSS 5.9 (medium), 2018-04-26: Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that…
CVE-2018-10322 - CVSS 5.5 (medium), 2018-04-24: The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel through 4.16.3 allows local users to cause a denial of service…
CVE-2018-1088 - CVSS 8.1 (high), 2018-04-18: A privilege escalation flaw was found in gluster 3.x snapshot scheduler. Any gluster client allowed to mount gluster volumes could also mount shared gluster…
CVE-2018-8088 - CVSS 9.8 (critical), 2018-03-20: org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted…
CVE-2018-1068 - CVSS 6.7 (medium), 2018-03-16: A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a…
CVE-2018-7740 - CVSS 5.5 (medium), 2018-03-07: The resv_map_release function in mm/hugetlb.c in the Linux kernel through 4.15.7 allows local users to cause a denial of service (BUG) via a crafted…
CVE-2018-6927 - CVSS 7.8 (high), 2018-02-12: The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or…
CVE-2017-7525 - CVSS 9.8 (critical), 2018-02-06: A deserialization flaw was discovered in the jackson-databind, versions before 2.6.7.1, 2.7.9.1 and 2.8.9, which could allow an unauthenticated user to…
CVE-2018-6485 - CVSS 9.8 (critical), 2018-02-01: An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause…
CVE-2018-1000001 - CVSS 7.8 (high), 2018-01-31: In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a…
CVE-2018-5750 - CVSS 5.5 (medium), 2018-01-26: The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by…
CVE-2018-5968 - CVSS 8.1 (high), 2018-01-22: FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the…
CVE-2017-7536 - CVSS 7 (high), 2018-01-10: In Hibernate Validator 5.2.x before 5.2.5 final, 5.3.x, and 5.4.x, it was found that when the security manager's reflective permissions, which allows it to…
CVE-2017-1000407 - CVSS 7.4 (high), 2017-12-11: The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel…
CVE-2017-1000410 - CVSS 7.5 (high), 2017-12-07: The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and…