Vulnerabilidades de Red Hat

CVEs publicadas que afetam produtos de Red Hat: 1558 registro(s), com severidade, exploração e correções.

Somente exploradas (KEV) →

CVE-2026-106067 Média · 6.3 CWE-119 07/10/2026

Gimp: gimp: heap buffer overflow in hot color filter on oversized image

A heap-based buffer overflow was found in GIMP’s Hot color filter plug-in. For very large images, a pixel buffer is allocated using overflowing 32-bit width * height (and related) arithmetic while the filter’s pixel access path uses the true image size, after integer overflow in the allocation size

CVE-2026-106066 Média · 6.3 CWE-119 07/10/2026

Gimp: gimp: heap buffer overflow in raw data export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s raw data export plug-in. When exporting very large images, g_malloc() sizing based on overflowing width * height * bytes-per-pixel can allocate far less memory than GEGL reads or writes during export, following integer overflow

CVE-2026-106065 Média · 6.3 CWE-119 07/10/2026

Gimp: gimp: heap buffer overflow in pcx export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s PCX export plug-in. For images with extremely large width and height, buffer allocation uses overflowing 32-bit width * height arithmetic while subsequent GEGL operations use the full extent, after integer overflow in size calculation

CVE-2026-107174 Média · 6.4 CWE-61 07/10/2026

Source-to-image: source-to-image: security boundary bypass via absolute symbolic link extraction

A flaw was found in source-to-image. When unpacking archive files, the application fails to properly sanitize symbolic links pointing to absolute file paths. An attacker who supplies a malicious builder image can exploit this vulnerability by embedding links pointing outside the extraction directory. This allows the attacker to bypass sandbox boundaries, potentially leading to unauthorized information disclosure or file modification on the host system.

CVE-2026-107169 Média · 6.2 CWE-476 07/10/2026

M17n-lib: null-pointer write in read_mtext_element() on malformed utf-8

A flaw was found in m17n-lib. An attacker could provide specially crafted or truncated UTF-8 input to trigger an unhandled null pointer dereference during text processing. This issue causes the application to crash unexpectedly, resulting in a Denial of Service (DoS).

CVE-2026-107167 Média · 6.2 CWE-416 07/10/2026

M17n-lib: heap use-after-free write in re_init_ic()

A flaw was found in m17n-lib. A user providing specially crafted text input can trigger a heap use-after-free condition during input-method state transitions. Under specific conditions, the library frees an internal input context object but subsequently attempts to write to that freed memory. This issue can cause applications relying on the library to crash, leading to a Denial of Service (DoS), or potentially allow arbitrary code execution.

CVE-2026-106064 Média · 6.3 CWE-119 07/10/2026

Gimp: gimp: heap buffer overflow in gif export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s GIF export plug-in. Exporting an image with very large width and height can cause 32-bit overflow when computing the pixel buffer size. The plug-in allocates a buffer based on the wrapped value while GEGL writes using the true image extent, rooted in integer overflow

CVE-2026-107170 Baixa · 2.9 CWE-476 07/10/2026

M17n-lib: null dereference in minput_open_im() after failed m17n_init()

A flaw was found in m17n-lib. A partial failure during library initialization can leave an internal driver pointer uninitialized. Under specific error conditions, such as system resource exhaustion or database corruption, an application attempting to open an input method dereferences this null pointer without proper validation. This issue causes the application to crash, resulting in a Denial of Service (DoS).

CVE-2026-107168 Média · 6.2 CWE-835 07/10/2026

M17n-lib: parser infinite loop on malformed utf-8 in count_utf_8_chars()

A flaw was found in m17n-lib. By providing crafted input containing an invalid UTF-8 character sequence, an attacker can cause the text parsing function to enter an infinite loop. This issue leads to sustained high CPU utilization, resulting in a Denial of Service (DoS) for the affected application.

CVE-2026-107151 Média · 5.9 CWE-306 07/10/2026

Rubygem-smart_proxy_dynflow: task update and done callbacks accept unauthenticated requests

Missing authentication has been found in remote-execution task updates in the smart_proxy_dynflow package. The progress and completion callbacks accept a report when the one-time token is missing. A network attacker or user must already know the identifier of a running job. This applies when remote execution is set to pull or pull-mqtt mode. They can send their own job output and mark the job as a success or a failure. The job is then recorded with that result.

CVE-2026-107121 Média · 6.5 CWE-319 07/10/2026

Keycloak-services: keycloak-services: smtp starttls plaintext credential and message downgrade

A flaw was found in the SMTP email configuration handling of the keycloak-services component. When the STARTTLS option is enabled, Keycloak fails to strictly enforce an encrypted connection, allowing it to fall back to unencrypted communication if the encryption request is tampered with. An attacker who can intercept network traffic can exploit this to capture sensitive email credentials and message content in plain text.

CVE-2026-103870 Média · 5.0 CWE-22 07/10/2026

Pulp-rpm: distribution tree publish creates directories from .treeinfo ids

A flaw was found in pulp-rpm when it publishes a distribution tree. Addon and variant ids from .treeinfo are used as directory names. A user who can sync or upload that tree can make the publish task create a new directory outside the task work area and write that tree's repository metadata and packages there, as the Pulp worker user. An existing file or directory is not replaced. The flaw does not disclose data and does not stop the service.

CVE-2026-103869 Média · 6.5 CWE-488 07/10/2026

Pulp-ansible: bearer tokens are reused across remotes in a worker

A flaw was found in pulp-ansible's bearer-token refresh for collection remotes. The access token is kept in one module-level variable and reused for every token download in that worker. A user who can sync an Ansible remote that uses token refresh, and can point that remote at a server they control, receives an access token obtained for a different remote, and can reuse it at the service that issued it. Content stored in Pulp is not changed, and the service is not stopped.

CVE-2026-103868 Média · 6.5 CWE-488 07/10/2026

Pulp-container: registry credentials are reused across remotes in a worker

A flaw was found in pulp-container when it authenticates to an upstream registry. Basic and bearer credentials from one remote are reused for later downloads in the same worker. A user who can sync a container remote, and can point that remote at a server they control, receives the username, password, or bearer token stored for a different remote, and can reuse that credential at the upstream registry. Content stored in Pulp is not changed, and the service is not stopped.

CVE-2026-106061 Média · 5.5 CWE-125 07/10/2026

Gimp: gimp: heap buffer over-read in x cursor (xmc) thumbnail loader on crafted file

A flaw was found in GIMP’s X cursor (XMC) thumbnail loader. When GIMP generates a thumbnail for a crafted XMC file, it allocates a pixel buffer using a width * height size computed in 32-bit signed arithmetic. If that product overflows, the allocation is smaller than the true image extent. A subsequent GEGL buffer read uses the unwrapped dimensions and performs an out-of-bounds read on the heap, after integer overflow in the size calculation. This can crash GIMP or corrupt process memory.

CVE-2026-106471 Alta · 8.1 CWE-863 06/10/2026

Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching

A flaw was found in Candlepin. The central authorization filter incorrectly grants access when any one of multiple @Verify-annotated parameters is accessible, instead of requiring access to every verified entity. A low-privilege authenticated attacker who can access the first referenced object can bypass authorization checks on subsequent objects. When target resource identifiers are known, this can enable unauthorized disclosure of consumer information and unauthorized modification of entitlements and related subscription resources, including across organizations.

CVE-2026-80048 Média · 5.5 CWE-770 06/10/2026

Sssd: sssd-kcm: local denial of service via excessive memory preallocation

A flaw was found in `sssd-kcm`. A local user or process able to connect to the `sssd-kcm` UNIX socket can exploit this vulnerability. By sending a large request length header and then stalling the connection, an attacker can cause the system to preallocate significant memory. This leads to memory exhaustion within the `sssd-kcm` responder, resulting in a Denial of Service (DoS) for affected deployments.

CVE-2026-106062 Alta · 7.8 CWE-119 06/10/2026

Gimp: gimp: heap buffer overflow in dds loader on crafted directdraw surface file

A heap-based buffer overflow was found in GIMP’s DirectDraw Surface (DDS) loader. When loading a crafted DDS image, buffer sizes derived from width, height, and pitch can be computed using 32-bit arithmetic that overflows. The allocated buffer is too small for the amount of pixel data written through GEGL, following integer overflow in size calculations. This may allow heap corruption and, in the worst case, arbitrary code execution in the context of the GIMP process.

CVE-2026-104046 Média · 6.2 CWE-770 06/10/2026

Sssd: sssd: denial of service via incomplete identity provider authentication requests

A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services.

CVE-2026-104045 Média · 4.7 CWE-772 06/10/2026

Sssd: sssd: denial of service via race condition in autofs responder

A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.

CVE-2026-101258 Alta · 7.8 CWE-787 06/10/2026

Ghostscript: ghostscript: -dsafer sandbox bypass via type 5 shading oob write and procedure-stream use-after-free

A flaw was found in Ghostscript. When Ghostscript renders a crafted PostScript or EPS document, it can bypass the -dSAFER sandbox and execute arbitrary shell commands in the context of the Ghostscript process. The issue chains memory corruption in document parsing with disabling of internal path access controls at runtime. An attacker can deliver the document directly or through formats that delegate rendering to Ghostscript (for example EPS import or print conversion workflows). Successful exploitation can compromise confidentiality, integrity, and availability of data accessible to the process running Ghostscript.

CVE-2026-76061 Média · 5.5 CWE-59 06/10/2026

Cri-o: cri-o: bind_mount_prefix intermediate-symlink prefix bypass

A flaw was found in CRI-O's `bind_mount_prefix` handling. When configured with a non-empty `bind_mount_prefix`, a malicious container or local attacker could use a Container Runtime Interface (CRI) hostPath containing an intermediate absolute symlink. This could cause the bind mount source to resolve outside the intended prefixed root, potentially leading to unauthorized access to files or privilege escalation on the host system.

CVE-2026-106063 Média · 6.3 CWE-119 06/10/2026

Gimp: gimp: heap buffer overflow in dicom export on oversized image dimensions

A heap-based buffer overflow was found in GIMP’s DICOM export plug-in. When exporting an image with extremely large width and height, the export path allocates a buffer using a 32-bit width * height (and bytes-per-pixel) product that can overflow. GEGL then writes the full uncompressed extent into the undersized buffer, after integer overflow in the allocation size

CVE-2026-104048 Alta · 8.1 CWE-1025 06/10/2026

Sssd: sssd: authorization bypass via cross-domain username collision in hbac evaluation

A flaw was found in SSSD. In trust-enabled identity management environments, SSSD evaluates Host-Based Access Control (HBAC) rules by stripping domain qualifiers and comparing only short usernames. An authenticated user in a trusted domain who shares the same username as an authorized local account can bypass access policies and gain unauthorized access to protected services or hosts.

CVE-2026-104047 Média · 5.3 CWE-140 06/10/2026

Sssd: sssd: information disclosure via query injection in entra id lookups

A flaw was found in SSSD. When configured to use Microsoft Entra ID, search inputs are not properly sanitized before being incorporated into directory query filters. A local user can exploit this vulnerability by submitting a crafted lookup request, manipulating the query logic to cause unauthorized information disclosure from the directory.