Red Hat vulnerabilities

Published CVEs affecting Red Hat products: 1670 record(s), with severity, exploitation and fixes.

Exploited only (KEV) →

CVE-2020-1712 High · 7.8 CWE-416 Mar 31, 2020

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where...

A heap use-after-free vulnerability was found in systemd before version v245-rc1, where asynchronous Polkit queries are performed while handling dbus messages. A local unprivileged attacker can abuse this flaw to crash systemd services or potentially execute code and elevate their privileges, by sending specially crafted dbus messages.

CVE-2020-10531 High · 8.8 CWE-190 Mar 12, 2020

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An...

An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow, exists in the UnicodeString::doAppend() function in common/unistr.cpp.

CVE-2019-14893 Critical · 9.8 CWE-502 Mar 2, 2020

Deserialization of Untrusted Data in Fasterxml Jackson-databind

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as `enableDefaultTyping()` or when @JsonTypeInfo is using `Id.CLASS` or `Id.MINIMAL_CLASS` or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

CVE-2019-14892 Critical · 9.8 CWE-502 Mar 2, 2020

Deserialization of Untrusted Data in Fasterxml Jackson-databind

A flaw was discovered in jackson-databind in versions before 2.9.10, 2.8.11.5 and 2.6.7.3, where it would permit polymorphic deserialization of a malicious object using commons-configuration 1 and 2 JNDI classes. An attacker could use this flaw to execute arbitrary code.

CVE-2020-6418 High · 8.8 KEV Urgent · 76 Public exploit CWE-843 Feb 27, 2020

Google Chromium V8 Type Confusion Vulnerability

Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVE-2019-20445 Critical · 9.1 CWE-444 Jan 29, 2020

HTTP Request Smuggling in Netty

HttpObjectDecoder.java in Netty before 4.1.44 allows a Content-Length header to be accompanied by a second Content-Length header, or by a Transfer-Encoding header.

CVE-2019-20444 Critical · 9.1 CWE-444 Jan 29, 2020

HTTP Request Smuggling in Netty

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

CVE-2019-19925 High · 7.5 CWE-434 Dec 24, 2019

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update...

zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.

CVE-2019-19923 High · 7.5 CWE-476 Dec 24, 2019

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving...

flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can cause a NULL pointer dereference (or incorrect results).

CVE-2019-19926 High · 7.5 CWE-476 Dec 22, 2019

multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as...

multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this vulnerability exists because of an incomplete fix for CVE-2019-19880.

CVE-2019-19906 High · 7.5 CWE-193 Dec 19, 2019

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote...

cyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.

CVE-2019-8506 High · 8.8 KEV High · 64 Public exploit CWE-843 Dec 18, 2019

Apple Multiple Products Type Confusion Vulnerability

A type confusion issue was addressed with improved memory handling. This issue is fixed in iOS 12.2, tvOS 12.2, watchOS 5.2, Safari 12.1, iTunes 12.9.4 for Windows, iCloud for Windows 7.11. Processing maliciously crafted web content may lead to arbitrary code execution.

CVE-2019-19880 High · 7.5 CWE-476 Dec 18, 2019

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer...

exprListAppendList in window.c in SQLite 3.30.1 allows attackers to trigger an invalid pointer dereference because constant integer values in ORDER BY clauses of window definitions are mishandled.

CVE-2019-5544 Critical · 9.8 KEV Urgent · 83 Public exploit Ransomware CWE-787 Dec 6, 2019

VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability

OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.

CVE-2013-4235 Medium · 4.7 CWE-367 Dec 3, 2019

shadow: TOCTOU (time-of-check time-of-use) race condition when copying and removing directory trees

CVE-2019-19242 Medium · 5.9 CWE-476 Nov 27, 2019

SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in...

SQLite 3.30.1 mishandles pExpr->y.pTab, as demonstrated by the TK_COLUMN case in sqlite3ExprCodeTarget in expr.c.

CVE-2019-19081 Medium · 5.9 CWE-401 Nov 18, 2019

Missing Release of Memory after Effective Lifetime in Linux Linux Kernel

A memory leak in the nfp_flower_spawn_vnic_reprs() function in drivers/net/ethernet/netronome/nfp/flower/main.c in the Linux kernel before 5.3.4 allows attackers to cause a denial of service (memory consumption), aka CID-8ce39eb5a67a.

CVE-2019-19066 Medium · 4.7 CWE-401 Nov 18, 2019

Missing Release of Memory after Effective Lifetime in Linux Linux Kernel

A memory leak in the bfad_im_get_stats() function in drivers/scsi/bfa/bfad_attr.c in the Linux kernel through 5.3.11 allows attackers to cause a denial of service (memory consumption) by triggering bfa_port_get_stats() failures, aka CID-0e62395da2bd.

CVE-2019-10219 Medium · 6.1 CWE-79 Nov 8, 2019

Cross-site Scripting (XSS) in Red Hat Hibernate Validator

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS attack.

CVE-2019-5010 High · 7.5 CWE-476 Oct 31, 2019

NULL Pointer Dereference in Python

An exploitable denial-of-service vulnerability exists in the X509 certificate parser of Python.org Python 2.7.11 / 3.6.6. A specially crafted X509 certificate can cause a NULL pointer dereference, resulting in a denial of service. An attacker can initiate or accept TLS connections using crafted certificates to trigger this vulnerability.

CVE-2019-11043 Critical · 9.8 KEV Urgent · 90 Public exploit Ransomware CWE-787 Oct 28, 2019

PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability

In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.

CVE-2019-17531 Critical · 9.8 CWE-502 Oct 12, 2019

Deserialization of Untrusted Data in Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

CVE-2019-17267 Critical · 9.8 CWE-502 Oct 6, 2019

Deserialization of Untrusted Data in Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

CVE-2019-16943 Critical · 9.8 CWE-502 Oct 1, 2019

Deserialization of Untrusted Data in Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

CVE-2019-16942 Critical · 9.8 CWE-502 Oct 1, 2019

Deserialization of Untrusted Data in Fasterxml Jackson-databind

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.