Red Hat Enterprise Linux Server vulnerabilities

CVE-2025-6021 High · 7.5 CWE-787 Jun 12, 2025

Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2

A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when processing crafted input.

CVE-2024-12085 High · 7.5 CWE-908 Jan 14, 2025

Rsync: info leak via uninitialized stack contents

A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.

CVE-2024-1086 High · 7.8 KEV Urgent · 72 Public exploit Ransomware CWE-416 Jan 31, 2024

Linux Kernel Use-After-Free Vulnerability

A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660.

CVE-2019-8720 High · 8.8 KEV High · 52 CWE-119 Mar 6, 2023

WebKitGTK Memory Corruption Vulnerability

A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.

CVE-2021-4034 High · 7.8 KEV Urgent · 86 Public exploit Ransomware CWE-125 Jan 28, 2022

Red Hat Polkit Out-of-Bounds Read and Write Vulnerability

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.

CVE-2021-40438 Critical · 9.0 KEV Urgent · 83 Public exploit Ransomware CWE-918 Sep 16, 2021

Apache HTTP Server-Side Request Forgery (SSRF)

A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.

CVE-2020-10531 High · 8.8 CWE-190 Mar 12, 2020

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An...

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVE-2020-6418 High · 8.8 KEV Urgent · 76 Public exploit CWE-843 Feb 27, 2020

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2019-19925 High · 7.5 CWE-434 Dec 24, 2019

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update...

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

CVE-2019-19923 High · 7.5 CWE-476 Dec 24, 2019

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving...

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

CVE-2019-19926 High · 7.5 CWE-476 Dec 22, 2019

multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as...

multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

CVE-2019-8506 High · 8.8 KEV High · 64 Public exploit CWE-843 Dec 18, 2019

Apple Multiple Products Type Confusion Vulnerability

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2019-19880 High · 7.5 CWE-476 Dec 18, 2019

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer...

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

CVE-2019-5544 Critical · 9.8 KEV Urgent · 77 Public exploit Ransomware CWE-787 Dec 6, 2019

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVE-2019-11043 Critical · 9.8 KEV Urgent · 90 Public exploit Ransomware CWE-787 Oct 28, 2019

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVE-2019-10086 High · 7.3 CWE-502 Aug 20, 2019

Deserialization of Untrusted Data in Apache Software Foundation Commons Beanutils

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

CVE-2019-10160 Critical · 9.8 CWE-172 Jun 7, 2019

A security regression of CVE-2019-9636 was discovered in python since commit...

A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and from v3.8.0a4 through v3.8.0b1, which still allows an attacker to exploit CVE-2019-9636 by abusing the user and password parts of a URL. When an application parses user-supplied URLs to store cookies, authentication credentials, or other kind of information, it is possible for an attacker to provide specially crafted URLs to make the application locate host-related information (e.g. cookies, authentication data) and send them to a different host than where it should, unlike if the URLs had been correctly parsed. The result of an attack may vary based on the application.

CVE-2019-3857 High · 8.8 CWE-190 Mar 25, 2019

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2...

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVE-2019-3856 High · 8.8 CWE-190 Mar 25, 2019

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2...

An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVE-2019-3863 High · 8.8 CWE-787 Mar 25, 2019

A flaw was found in libssh2 before 1.8.1. A server could send a multiple keyboard interactive...

A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side. A server could send a multiple keyboard interactive response messages whose total length are greater than unsigned char max characters. This value is used by the SSH client as an index to copy memory causing in an out of bounds memory write error.

CVE-2019-9948 Critical · 9.1 CWE-22 Mar 23, 2019

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for...

urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as demonstrated by triggering a urllib.urlopen('local_file:///etc/passwd') call.

CVE-2019-3855 High · 8.8 CWE-190 Mar 21, 2019

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2...

An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server. A remote attacker who compromises a SSH server may be able to execute code on the client system when a user connects to the server.

CVE-2019-9636 Critical · 9.8 CWE-173 Mar 8, 2019

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode...

Python 2.7.x through 2.7.16 and 3.x through 3.7.2 is affected by: Improper Handling of Unicode Encoding (with an incorrect netloc) during NFKC normalization. The impact is: Information disclosure (credentials, cookies, etc. that are cached against a given hostname). The components are: urllib.parse.urlsplit, urllib.parse.urlparse. The attack vector is: A specially crafted URL could be incorrectly parsed to locate cookies or authentication data and send that information to a different host than when parsed correctly. This is fixed in: v2.7.17, v2.7.17rc1, v2.7.18, v2.7.18rc1; v3.5.10, v3.5.10rc1, v3.5.7, v3.5.8, v3.5.8rc1, v3.5.8rc2, v3.5.9; v3.6.10, v3.6.10rc1, v3.6.11, v3.6.11rc1, v3.6.12, v3.6.9, v3.6.9rc1; v3.7.3, v3.7.3rc1, v3.7.4, v3.7.4rc1, v3.7.4rc2, v3.7.5, v3.7.5rc1, v3.7.6, v3.7.6rc1, v3.7.7, v3.7.7rc1, v3.7.8, v3.7.8rc1, v3.7.9.

CVE-2018-15982 High · 7.8 KEV Urgent · 74 Public exploit Ransomware CWE-416 Jan 18, 2019

Adobe Flash Player Use-After-Free Vulnerability

Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have a use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

CVE-2018-17480 High · 8.8 KEV High · 56 CWE-787 Dec 11, 2018

Google Chromium V8 Out-of-Bounds Write Vulnerability

Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.