Fixed packages 32
| Release | Package | Fixed in |
|---|---|---|
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | openvox-agent | 0:8.32.0-1.el9sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | openvox-server | 0:8.18.0-1.el9sat |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python-brotli | 0:1.2.1-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python-brotli-debugsource | 0:1.2.1-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python-django | 0:4.2.30-2.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python-gitpython | 0:3.2.1-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python-pillow | 0:13.0.0-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python-pillow-debugsource | 0:13.0.0-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python-urllib3 | 0:2.8.0-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python3.11-brotli | 0:1.2.1-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python3.11-brotli-debuginfo | 0:1.2.1-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python3.11-django | 0:4.2.30-2.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python3.11-gitpython | 0:3.2.1-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python3.11-pillow | 0:13.0.0-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python3.11-pillow-debuginfo | 0:13.0.0-1.el9pc |
| Red Hat · Satellite Capsule 6 satellite_capsule:6.17::el9 | python3.11-urllib3 | 0:2.8.0-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | openvox-agent | 0:8.32.0-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | openvox-server | 0:8.18.0-1.el9sat |
| Red Hat · Satellite 6 satellite:6.17::el9 | python-brotli | 0:1.2.1-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python-brotli-debugsource | 0:1.2.1-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python-django | 0:4.2.30-2.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python-gitpython | 0:3.2.1-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python-pillow | 0:13.0.0-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python-pillow-debugsource | 0:13.0.0-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python-urllib3 | 0:2.8.0-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python3.11-brotli | 0:1.2.1-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python3.11-brotli-debuginfo | 0:1.2.1-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python3.11-django | 0:4.2.30-2.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python3.11-gitpython | 0:3.2.1-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python3.11-pillow | 0:13.0.0-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python3.11-pillow-debuginfo | 0:13.0.0-1.el9pc |
| Red Hat · Satellite 6 satellite:6.17::el9 | python3.11-urllib3 | 0:2.8.0-1.el9pc |
Vulnerabilities 41
-
Critical 10.0
Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an unauthenticated user to execute arbitrary code on the GitLab server…
KEV Oct 29, 2026 -
Critical 9.2
Out-of-Bounds Write in Google Brotli Decoder
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …
KEV Oct 27, 2026 -
Critical 10.0CVE-2026-110264 Public exploit
Integer Overflow or Wraparound in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 7.0 before 18.11.13, 19.0 before 19.0.10, 19.1 before 19.1.9, 19.2 before 19.2.9, 19.3 before 19.3.6, 19.4 before 19.4.3, and 19.5 before 19.5.1 that, under certain conditions, could hav…
-
Critical 9.9
Double Free in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…
-
Critical 9.9
Integer Overflow or Wraparound in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.2 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to execute arbitrary code on the GitLab server due…
-
Critical 9.4
Report Deserialization Code Execution
Deserialization of untrusted data in the report-processing code of Puppet, as used by Puppet Server, in the affected releases, allows a client that holds any CA-signed agent certificate to execute arbitrary code on the Puppet Server as its service user by sub…
-
Critical 9.2
Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in _tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno(), such as BytesIO. The callback si…
-
Critical 9.2CVE-2026-112398 Public exploit
Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix JPEG-tile decoder can write decoded scanlines beyond the allocated tile buffer. FlashPix (FPX) JPEG decoding selects raw mode LA with two bytes per pixel, while an unrecognized JPEG mode c…
-
Critical 9.2CVE-2026-112403 Public exploit
Pillow: Heap buffer overflow in ImagingJpegDecode
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG decoder can write a full-width scanline into a buffer sized for a requested draft scale. ImagingJpegDecode does not verify libjpeg's actual output width and component count after scaling is re…
-
Critical 9.0
Certificate Name Authorization Bypass
Incorrect authorization in the certificate-name matching of trapperkeeper-authorization, as used by Puppet Server, in the affected products, allows a client that holds a CA-signed certificate whose name extends or shortens an authorized hostname to be authori…
-
High 8.9
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
urllib3 is an HTTP client library for Python. From 1.10.3 until 2.8.0, the HTTPResponse.read_chunked and HTTPResponse.stream methods can allocate unbounded memory because the streaming chunk parser buffers the chunk-size field until newline or EOF without a l…
-
High 8.8
Pillow: OOB read in TiffDecode.c tile and RGBA paths leaks heap memory into pixels
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretati…
-
High 8.8
Pillow: TIFF encoder ColorMap plane-size mismatch causes a heap out-of-bounds read
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's TIFF encoder can read beyond a ColorMap buffer when retained TIFF metadata has a plane size inconsistent with BitsPerSample. A small TIFF can be opened normally and then retain a crafted ColorMap t…
-
High 8.8
Server-side file-write and request forgery via spatial lookups
An issue was discovered in Django 5.2 before 5.2.17 and 6.0 before 6.0.8. GeoDjango spatial lookups optimistically parse the right-hand-side value as a raster by passing it to the `django.contrib.gis.gdal.GDALRaster` constructor. Any value used in a spatial l…
-
High 8.7
Pillow: Out-of-bounds access in _imagingmorph on a zero-width image
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply() can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrow[widt…
-
High 8.7
Pillow: APNG background disposal allocates full canvas before decompression bomb check
Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow can allocate an APNG disposal background at the full canvas size before applying the decompression-bomb check. A crafted APNG with a small first frame, a very large declared canvas, and backg…
-
High 8.7
Pillow: GIF seek keeps rejected size after DecompressionBombError, allowing DoS
Pillow is a Python imaging library. From 9.2.0 until 13.0.0, Pillow can retain a rejected GIF frame size after a decompression-bomb exception. In GifImageFile._seek, a crafted GIF can leave rejected dimensions stored after Image.DecompressionBombError; if an …
-
High 8.7
Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform
Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations…
-
High 8.7
Pillow: NULL pointer dereference in Image.merge via an unvalidated band 0
Pillow is a Python imaging library. From 12.0.0 until 13.0.0, Pillow's Image.merge() can dereference a null image8 plane. Validation skips the first input band, allowing a 32-bit integer or floating-point image backed by image32 storage to be merged as a narr…
-
High 8.7
Pillow: Infinite loop in PdfParser.rewrite_pages on page tree Parent cycle
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can enter an infinite loop while rewriting PDF pages. PdfParser.rewrite_pages() follows Parent relationships without detecting a cycle in the page tree. An attacker can supply a cyclic PDF to…
-
High 8.7
Pillow: MSP RLE decoder expands a tiny file into unbounded memory
Pillow is a Python imaging library. From 4.1.0 until 13.0.0, Pillow's MSP RLE decoder can expand a small file into an unbounded in-memory buffer. The decoder writes run-length output to BytesIO without limiting expansion to the declared image size. An attacke…
-
High 8.7
Pillow: Quadratic-time DoS in PDF save_all (PdfParser.next_object_id)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow takes quadratic time to reserve PDF object identifiers when saving many frames with save_all enabled. PdfParser.next_object_id() repeatedly rebuilds and scans all previously reserved identifi…
-
High 8.7
Pillow: Unbounded recursion parsing a PDF page tree or trailer chain (incomplete fix for CVE-2026-42310)
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow can exhaust resources while parsing an existing PDF during an append operation. PdfParser follows page-tree child references without cycle or duplication tracking and follows previous-trailer…
-
High 8.7
Pillow: TiffDecode returns uninitialized memory as pixels for short JPEG strips
Pillow is a Python imaging library. From 5.3.0 until 13.0.0, Pillow can return uninitialized memory as pixels when libtiff performs a short decode of JPEG-compressed or Group 4 fax TIFF data. The _decodeStrip and _decodeTile buffers can be larger than the byt…
-
High 8.2
Pillow: Infinite loop in MIC n_frames when the embedded TIFF
Pillow is a Python imaging library. From 7.2.0 until 13.0.0, Pillow can enter an infinite loop while determining the frame count of a MIC image. MicImageFile inherits TIFF frame traversal, but MicImageFile.tell reports the OLE stream index and its seek() rese…
-
High 8.2
Pillow: NULL dereference in ImagingExpand via rank filters on zero-size images
Pillow is a Python imaging library. Prior to 13.0.0, Pillow's rank-based filters can dereference invalid image storage for a zero-size image. ImagingExpand() allocates a non-empty output and then faults while replicating edges by reading the first pixel from …
-
High 8.2
Pillow: Invalid free in FreeType glyph rendering when a stroker is active
Pillow is a Python imaging library. From 10.0.0 until 13.0.0, Pillow can free an invalid glyph pointer during FreeType rendering with an active stroker. If FT_Load_Glyph fails, cleanup may call FT_Done_Glyph on an uninitialized or stale glyph variable. An att…
-
High 8.2
Pillow PDF append accepts malformed shared page-tree DAG causing resource exhaustion
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, PdfParser.linearize_page_tree() in src/PIL/PdfParser.py treats a PDF /Pages graph as a tree without tracking duplicate indirect references. When Image.save(..., format="PDF", append=True) processes …
-
High 8.1
GitPython 3.1.30 before 3.2.0 Command Injection via Remote.pull() Refspec
GitPython from 3.1.30 before 3.2.0 contains a remote code execution vulnerability in Remote.pull() whose unsafe-option guard inspects only keyword arguments, not the positional refspec. Attackers controlling the refspec can supply --upload-pack=<command> to e…
-
High 7.7CVE-2026-96778 Public exploit
Pillow: Heap buffer overflow writing JPEG comment after ICC profile fills buffer
Pillow is a Python imaging library. From 9.4.0 until 13.0.0, ImagingJpegEncode() in src/libImaging/JpegEncode.c can call jpeg_write_marker() for a JPEG COM comment when an ICC profile has exactly filled the 65536-byte encoder buffer. libjpeg writes one byte b…
-
High 7.6
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
urllib3 is an HTTP client library for Python. From 1.26.0 until 2.8.0, the proxy_ssl_context, proxy_assert_hostname, proxy_assert_fingerprint, ssl_context, cert_reqs, verify_mode, use_forwarding_for_https=True, and CERT_NONE configuration paths fail to remain…
-
High 7.5
jackson-dataformat-smile: unbounded eager byte[] allocation for raw binary in the async parser allows OutOfMemoryError denial of service
The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input to allocate a byte[] before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, _decodeVInt() compute…
-
High 7.5
GitPython before 3.2.0 ReDoS via _re_actor_epoch in parse_actor_and_date
GitPython before 3.2.0 contains a regular expression denial of service vulnerability in the _re_actor_epoch pattern used by parse_actor_and_date on author, committer, and tagger lines. Attackers can serve repositories with commit or tag objects containing lon…
-
High 7.5
GitPython before 3.2.0 Command Execution via ls_remote ext:: URLs
GitPython before 3.2.0 contains a remote code execution vulnerability that allows attackers to run commands because Git.ls_remote forwards URLs without check_unsafe_protocols validation. Attackers can supply ext:: remote-helper URLs to execute commands when g…
-
High 7.5
GitPython before 3.2.0 Arbitrary File Read via Head.checkout() Branch Name
GitPython before 3.2.0 contains an argument injection vulnerability in Head.checkout() that allows remote attackers to read arbitrary files by supplying a branch name parsed as a git option. Attackers can host a repository whose default branch is named --path…
-
High 7.5
GitPython validates a submodule's ".git" path only after cloning into it (RCE)
GitPython is a python library used to interact with Git repositories. Prior to 3.2.1, create_submodule() in git/objects/submodule/base.py accepts an attacker-influenced submodule path such as .git/hooks and invokes _clone_repo() before safely rejecting the de…
-
High 7.5
GitPython before 3.1.59 Path Traversal via separate-git-dir
GitPython before 3.1.59 omits --separate-git-dir from unsafe_git_clone_options, allowing attackers to create arbitrary git directories outside the intended clone destination. Attackers can pass a separate_git_dir parameter to Repo.clone_from() or Repo.clone()…
-
High 7.5
GitPython before 3.1.60 Denial of Service via ReDoS
GitPython before 3.1.60 contains a regular expression denial of service vulnerability in Actor.name_email_regex that processes commit author and committer fields. Attackers can craft a commit object with a malformed author field containing an unterminated ang…
-
High 7.1
Pillow: PNG eXIf chunk makes EXIF parsing run in quadratic time
Pillow is a Python imaging library. From 11.0.0 until 13.0.0, Exif.load() in src/PIL/Image.py repeatedly slices the remaining EXIF data while it begins with the six-byte Exif header. src/PIL/PngImagePlugin.py accepts an uncapped PNG eXIf chunk, so a file fill…
-
Medium 6.5
GitPython before 3.1.57 Arbitrary File Read via Repo.archive()
GitPython before 3.1.57 contains an incomplete denylist in the unsafe_git_archive_options guard that omits --add-file and --add-virtual-file options. Attackers can supply these options to Repo.archive() to read arbitrary files from the filesystem and include …
-
Medium 6.3
Pillow: PdfParser can recurse without limit in get_value() and linearize_page_tree()
Pillow is a Python imaging library. From 5.1.0 until 13.0.0, Pillow's PdfParser.get_value() can recurse without a limit while reading nested PDF objects. The parser follows attacker-controlled arrays and dictionaries when an existing PDF is opened for append.…
References
-
article
https://access.redhat.com/security/updates/classification/#critical
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2511095
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2515265
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2523215
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2530742
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539836
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2539842
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543245
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2543255
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2550153
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2552959
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2552966
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2552977
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2552989
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555846
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555848
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555851
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555859
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555863
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555864
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555866
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555867
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555868
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555871
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555873
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555874
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555875
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555878
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555879
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555888
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2555890
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2556322
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2558563
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2558566
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2558567
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2558576
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2558632
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2558973
-
report
https://bugzilla.redhat.com/show_bug.cgi?id=2559393