CVE-2023-6606

Kernel: out-of-bounds read vulnerability in smbcalcsize

An out-of-bounds read vulnerability was found in smbCalcSize in fs/smb/client/netmisc.c in the Linux Kernel. This issue could allow a local attacker to crash the system or leak internal kernel information.

CVSS 3.1 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Enterprise Linux Enterprise Linux Eus and 6 more

CVE-2023-6536

Kernel: null pointer dereference in __nvmet_req_complete

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Codeready Linux Builder Eus and 18 more

CVE-2023-6535

Kernel: null pointer dereference in nvmet_tcp_execute_request

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver, causing kernel panic and a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Codeready Linux Builder Eus Codeready Linux Builder Eus For Power Little Endian Eus and 17 more

CVE-2023-6356

Kernel: null pointer dereference in nvmet_tcp_build_iovec

A flaw was found in the Linux kernel's NVMe driver. This issue may allow an unauthenticated malicious actor to send a set of crafted TCP packages when using NVMe over TCP, leading the NVMe driver to a NULL pointer dereference in the NVMe driver and causing kernel panic and a denial of service.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Linux Redhat

Products

Debian Linux Linux Kernel Codeready Linux Builder Eus and 18 more

CVE-2023-5992

Opensc: side-channel leaks while stripping encryption pkcs#1 padding

A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data.

CVSS 3.1 · 5.6 Medium EPSS 1.2% KEV · Not listed

Vendors

Opensc Project Redhat

Products

Opensc Enterprise Linux Enterprise Linux Eus and 9 more

CVE-2023-5868

Postgresql: memory disclosure in aggregate function calls

A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type values from string literals without type designation can disclose bytes, potentially revealing notable and confidential information. This issue exists due to excessive data output in aggregate function calls, enabling remote users to read some portion of system memory.

CVSS 3.1 · 4.3 Medium EPSS 2.8% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Advanced Cluster Security Codeready Linux Builder Eus and 20 more

CVE-2023-5455

Ipa: invalid csrf protection

A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could perform actions as the user, resulting in a loss of confidentiality and system integrity. During community penetration testing it was found that for certain HTTP end-points FreeIPA does not ensure CSRF protection. Due to implementation details one cannot use this flaw for reflection of a cookie representing already logged-in user. An attacker would always have to go through a new authentication attempt.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Freeipa Redhat

Products

Fedora Freeipa Codeready Linux Builder and 23 more

CVE-2026-5201

Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image

A flaw was found in the gdk-pixbuf library. This heap-based buffer overflow vulnerability occurs in the JPEG image loader due to improper validation of color component counts when processing a specially crafted JPEG image. A remote attacker can exploit this flaw without user interaction, for example, via thumbnail generation. Successful exploitation leads to application crashes and denial of service (DoS) conditions.

CVSS 3.1 · 7.5 High EPSS 1.1% KEV · Not listed

Vendors

Gnome Redhat

Products

Gdk-pixbuf Ai Inference Server Enterprise Linux and 21 more

CVE-2026-4775

Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing

A flaw was found in the libtiff library. A remote attacker could exploit a signed integer overflow vulnerability in the putcontig8bitYCbCr44tile function by providing a specially crafted TIFF file. This flaw can lead to an out-of-bounds heap write due to incorrect memory pointer calculations, potentially causing a denial of service (application crash) or arbitrary code execution.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Debian Libtiff Redhat

Products

Debian Linux Libtiff Ai Inference Server and 17 more

CVE-2026-4424

Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing

A flaw was found in libarchive. This heap out-of-bounds read vulnerability exists in the RAR archive processing logic due to improper validation of the LZSS sliding window size after transitions between compression methods. A remote attacker can exploit this by providing a specially crafted RAR archive, leading to the disclosure of sensitive heap memory information without requiring authentication or user interaction.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Libarchive Redhat

Products

Libarchive Ai Inference Server Cert Manager and 19 more

CVE-2026-42009

Gnutls: gnutls: denial of service via dtls packet reordering vulnerability

A flaw was found in gnutls. A remote attacker could exploit an issue in the Datagram Transport Layer Security (DTLS) packet reordering logic. The comparator function, responsible for ordering DTLS packets by sequence numbers, did not correctly handle packets with duplicate sequence numbers. This could lead to unstable packet ordering or undefined behavior, resulting in a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.3% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ai Inference Server Cert Manager and 25 more

CVE-2025-3155

Yelp: arbitrary file read

A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an external environment.

CVSS 3.1 · 7.4 High EPSS 13.1% KEV · Not listed

Vendors

Debian Gnome Redhat

Products

Debian Linux Yelp Codeready Linux Builder and 23 more

CVE-2024-9675

Buildah: buildah allows arbitrary directory mount

A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Buildah Project Redhat

Products

Buildah Enterprise Linux Enterprise Linux Eus and 20 more

CVE-2024-0193

Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation

A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a use-after-free issue on an NFT_CHAIN object or NFT_OBJECT object, allowing a local unprivileged user with CAP_NET_ADMIN capability to escalate their privileges on the system.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Linux Redhat

Products

Linux Kernel Codeready Linux Builder Codeready Linux Builder For Eus and 24 more

CVE-2024-3049

Booth: specially crafted hash can lead to invalid hmac being accepted by booth server

A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Clusterlabs Redhat

Products

Booth Enterprise Linux Enterprise Linux Eus and 10 more

CVE-2024-1488

Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an unprivileged attacker to manipulate a running instance, potentially altering forwarders, allowing them to track all queries forwarded by the local resolver, and, in some cases, disrupting resolving altogether.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat

Products

Unbound Codeready Linux Builder Codeready Linux Builder Eus and 21 more

CVE-2024-0409

Xorg-x11-server: selinux context corruption

A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when initiating the cursor, that overwrites the XSELINUX context.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat Tigervnc and 1 more

Products

Fedora Enterprise Linux Enterprise Linux Desktop and 10 more

CVE-2024-0408

Xorg-x11-server: selinux unlabeled glx pbuffer

A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource (as with a GetGeometry) or when it creates another resource that needs to access that buffer, such as a GC, the XSELINUX code will try to use an object that was never labeled and crash because the SID is NULL.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Fedoraproject Redhat Tigervnc and 1 more

Products

Fedora Enterprise Linux Enterprise Linux Desktop and 10 more

CVE-2023-6816

Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer

A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be arbitrarily mapped to any value up to 255, but the X.Org Server was only allocating space for the device's particular number of buttons, leading to a heap overflow if a bigger value was used.

CVSS 3.1 · 9.8 Critical EPSS 2.1% KEV · Not listed

Vendors

Debian Fedoraproject Redhat and 1 more

Products

Debian Linux Fedora Enterprise Linux and 10 more

CVE-2023-5869

Postgresql: buffer overrun from integer overflow in array modification

A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user can trigger the overflow by providing specially crafted data. This enables the execution of arbitrary code on the target system, allowing users to write arbitrary bytes to memory and extensively read the server's memory.

CVSS 3.1 · 8.8 High EPSS 4.3% KEV · Not listed

Vendors

Postgresql Redhat

Products

Postgresql Advanced Cluster Security Codeready Linux Builder Eus and 25 more