CVE-2025-46397

Xfig: xfig: stack-overflow allows possible code execution via local input manipulation

A flaw was found in xfig. This vulnerability allows possible code execution via local input manipulation via bezier_spline function.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Fig2dev Project Redhat

Products

Fig2dev Enterprise Linux Rhel Els and 1 more

CVE-2025-4373

Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar

A flaw was found in GLib, which is vulnerable to an integer overflow in the g_string_insert_unichar() function. When the position at which to insert the character is large, the position will overflow, leading to a buffer underwrite.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Insights Proxy Openshift Distributed Tracing and 6 more

CVE-2025-49178

Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore

A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 4 more

CVE-2025-5372

Libssh: incorrect return code handling in ssh_kdf() in libssh

A flaw was found in libssh versions built with OpenSSL versions older than 3.0, specifically in the ssh_kdf() function responsible for key derivation. Due to inconsistent interpretation of return values where OpenSSL uses 0 to indicate failure and libssh uses 0 for success—the function may mistakenly return a success status even when key derivation fails. This results in uninitialized cryptographic key buffers being used in subsequent communication, potentially compromising SSH sessions' confidentiality, integrity, and availability.

CVSS 3.1 · 5 Medium EPSS < 1% KEV · Not listed

Vendors

Libssh Redhat

Products

Libssh Enterprise Linux Openshift and 6 more

CVE-2025-5222

Icu: stack buffer overflow in the srbroot::addtag function

A stack buffer overflow was found in Internationl components for unicode (ICU ). While running the genrb binary, the 'subtag' struct overflowed at the SRBRoot::addTag function. This issue may lead to memory corruption and local arbitrary code execution.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Redhat Unicode

Products

Enterprise Linux Openshift Rhel E4s and 3 more

CVE-2025-26465

Openssh: machine-in-the-middle attack if verifyhostkeydns is enabled

A vulnerability was found in OpenSSH when the VerifyHostKeyDNS option is enabled. A machine-in-the-middle attack can be performed by a malicious machine impersonating a legit server. This issue occurs due to how OpenSSH mishandles error codes in specific conditions when verifying the host key. For an attack to be considered successful, the attacker needs to manage to exhaust the client's memory resource first, turning the attack complexity high.

CVSS 3.1 · 6.8 Medium EPSS 7.7% KEV · Not listed

Vendors

Debian Netapp Openbsd and 1 more

Products

Debian Linux Active Iq Unified Manager Ontap and 7 more

CVE-2025-2784

Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content

A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a crafted HTTP response by an HTTP server.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Gnome Redhat

Products

Libsoup Codeready Linux Builder Codeready Linux Builder For Arm64 and 23 more

CVE-2025-2487

389-ds-base: null pointer dereference leads to denial of service

A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.

CVSS 3.1 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Directory Server Directory Server Eus Enterprise Linux and 2 more

CVE-2024-7006

Libtiff: null pointer dereference in tif_dirinfo.c

A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or injecting faults, causing a segmentation fault. This can cause an application crash, eventually leading to a denial of service.

CVSS 3.1 · 7.5 High EPSS 1.5% KEV · Not listed

Vendors

Libtiff Redhat

Products

Libtiff Enterprise Linux Enterprise Linux For Arm 64 and 4 more

CVE-2025-11234

Qemu-kvm: vnc websocket handshake use-after-free

A flaw was found in QEMU. If the QIOChannelWebsock object is freed while it is waiting to complete a handshake, a GSource is leaked. This can lead to the callback firing later on and triggering a use-after-free in the use of the channel. This can be abused by a malicious client with network access to the VNC WebSocket port to cause a denial of service during the WebSocket handshake prior to the VNC client authentication.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Aus and 5 more

CVE-2025-10911

Libxslt: use-after-free with key data stored cross-rvt

A use-after-free vulnerability was found in libxslt while parsing xsl nodes that may lead to the dereference of expired pointers and application crash.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Discovery Enterprise Linux Enterprise Linux Eus and 10 more

CVE-2024-9676

Podman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Enterprise Linux Eus Enterprise Linux For Arm 64 and 17 more

CVE-2024-9407

Buildah: podman: improper input validation in bind-propagation option of dockerfile run --mount instruction

A vulnerability exists in the bind-propagation option of the Dockerfile RUN --mount instruction. The system does not properly validate the input passed to this option, allowing users to pass arbitrary parameters to the mount instruction. This issue can be exploited to mount sensitive directories from the host into a container during the build process and, in some cases, modify the contents of those mounted files. Even if SELinux is used, this vulnerability can bypass its protection by allowing the source directory to be relabeled to give the container access to host files.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Openshift Rhel Eus

CVE-2024-8176

Libexpat: expat: improper restriction of xml entity expansion depth in libexpat

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

CVSS 3.1 · 7.5 High EPSS 1.4% KEV · Not listed

Vendors

Redhat

Products

Devworkspace Discovery Enterprise Linux and 8 more

CVE-2024-7409

Qemu: denial of service via improper synchronization in qemu nbd server during socket closure

A flaw was found in the QEMU NBD Server. This vulnerability allows a denial of service (DoS) attack via improper synchronization during socket closure when a client keeps a socket open as the server is taken offline.

CVSS 3.0 · 7.5 High EPSS 1.0% KEV · Not listed

Vendors

Redhat

Products

Advanced Virtualization Enterprise Linux Openshift and 2 more

CVE-2025-32990

Gnutls: vulnerability in gnutls certtool template parsing

A heap-buffer-overflow (off-by-one) flaw was found in the GnuTLS software in the template parsing logic within the certtool utility. When it reads certain settings from a template file, it allows an attacker to cause an out-of-bounds (OOB) NULL pointer write, resulting in memory corruption and a denial-of-service (DoS) that could potentially crash the system.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ceph Storage Discovery and 8 more

CVE-2025-32989

Gnutls: vulnerability in gnutls sct extension parsing

A heap-buffer-overread vulnerability was found in GnuTLS in how it handles the Certificate Transparency (CT) Signed Certificate Timestamp (SCT) extension during X.509 certificate parsing. This flaw allows a malicious user to create a certificate containing a malformed SCT extension (OID 1.3.6.1.4.1.11129.2.4.2) that contains sensitive data. This issue leads to the exposure of confidential information when GnuTLS verifies certificates from certain websites when the certificate (SCT) is not checked correctly.

CVSS 3.1 · 5.3 Medium EPSS 1.5% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ceph Storage Discovery and 8 more

CVE-2025-32988

Gnutls: vulnerability in gnutls othername san export

A flaw was found in GnuTLS. A double-free vulnerability exists in GnuTLS due to incorrect ownership handling in the export logic of Subject Alternative Name (SAN) entries containing an otherName. If the type-id OID is invalid or malformed, GnuTLS will call asn1_delete_structure() on an ASN.1 node it does not own, leading to a double-free condition when the parent function or caller later attempts to free the same structure. This vulnerability can be triggered using only public GnuTLS APIs and may result in denial of service or memory corruption, depending on allocator behavior.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Gnu Redhat

Products

Gnutls Ceph Storage Discovery and 8 more

CVE-2025-32914

Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process

A flaw was found in libsoup, where the soup_multipart_new_from_message() function is vulnerable to an out-of-bounds read. This flaw allows a malicious HTTP client to induce the libsoup server to read out of bounds.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Aus Rhel E4s and 3 more

CVE-2025-32907

Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header

A flaw was found in libsoup. The implementation of HTTP range requests is vulnerable to a resource consumption attack. This flaw allows a malicious client to request the same range many times in a single HTTP request, causing the server to use large amounts of memory. This does not allow for a full denial of service.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel E4s Rhel Els and 1 more