Red Hat Enterprise Linux: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 25

• Critical 10.0
  CVE-2023-28100

  TIOCLINUX can send commands outside sandbox if running on a virtual console

  Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4 contain a vulnerability similar to CVE-2017-5226, but using the `TIOCLINUX` ioctl command instead of `TIO…

  Flatpak Flatpak flatpak flatpak Debian Ubuntu
  Mar 16, 2023
• High 8.1
  CVE-2023-31486

  HTTP::Tiny before 0.083, a Perl core module since 5.13.9 and available standalone on CPAN, has an insecure default TLS …

  perl perl perl libhttp-tiny-perl Debian Ubuntu Azure Linux
  Apr 28, 2023
• High 7.8
  CVE-2021-32142

  Buffer Overflow vulnerability in LibRaw linux/unix v0.20.0 allows attacker to escalate privileges via the LibRaw_buffer…

  kodi dcraw libraw rawtherapee Debian Ubuntu Azure Linux
  Feb 17, 2023
• High 7.8
  CVE-2023-33204

  sysstat through 12.7.2 allows a multiplication integer overflow in check_overflow in common.c. NOTE: this issue exists …

  sysstat sysstat sysstat sysstat Debian Ubuntu Azure Linux Alpine Wolfi
  May 18, 2023
• High 7.5
  CVE-2022-40898

  pypa/wheel vulnerable to Regular Expression denial of service (ReDoS)

  An issue discovered in Python Packaging Authority (PyPA) Wheel 0.37.1 and earlier allows remote attackers to cause a denial of service via attacker controlled input to wheel cli.

  python-pip python-wheel wheel wheel Debian Ubuntu Azure Linux PyPI
  Dec 22, 2022
• High 7.5
  CVE-2023-26768

  Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the …

  liblouis liblouis liblouis Debian Ubuntu Azure Linux
  Mar 16, 2023
• High 7.5
  CVE-2023-28625

  mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied

  mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a N…

  OpenIDC mod_auth_openidc libapache2-mod-auth-openidc libapache2-mod-auth-openidc Debian Ubuntu Azure Linux
  Apr 3, 2023
• Medium 6.5
  CVE-2023-33460

  There's a memory leak in yajl 2.1.0 with use of yajl_tree_parse function. which will cause out-of-memory in server and …

  r-cran-jsonlite argyll yajl yajl Debian Ubuntu Azure Linux Alpine Wolfi
  Jun 6, 2023
• Medium 6.4
  CVE-2023-22745

  Buffer Overlow in TSS2_RC_Decode in tpm2-tss

  tpm2-tss is an open source software implementation of the Trusted Computing Group (TCG) Trusted Platform Module (TPM) 2 Software Stack (TSS2). In versions prior to 4.1.0-rc0, 4.0.1, and 3.2.2-rc1, `Tss2_RC_SetHandler` and `Tss2_RC_Decode` both index into `lay…

  tpm2-software tpm2-tss tpm2-tss tpm2-tss Debian Ubuntu Azure Linux
  Jan 19, 2023
• Medium 6.1
  CVE-2023-28370

  Open redirect in Tornado

  Open redirect vulnerability in Tornado versions 6.3.1 and earlier allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and conduct a phishing attack by having user access a specially crafted URL.

  tornadoweb tornado salt python-tornado Debian Ubuntu Azure Linux PyPI
  May 25, 2023
• Medium 5.5
  CVE-2022-48468

  protobuf-c before 1.4.1 has an unsigned integer overflow in parse_required_member.

  protobuf-c protobuf-c protobuf-c libsignal-protocol-c Debian Ubuntu Azure Linux
  Apr 13, 2023
• Medium 5.5
  CVE-2023-1786

  sensitive data exposure in cloud-init logs

  Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.

  Canonical cloud-init cloud-init cloud-init Debian Ubuntu Azure Linux Alpine
  Apr 26, 2023
• Medium 5.5
  CVE-2023-29499

  Gvariant offset table entry size is not checked in is_normal()

  A flaw was found in GLib. GVariant deserialization fails to validate that the input conforms to the expected format, leading to denial of service.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Sep 14, 2023
• Medium 5.5
  CVE-2023-32611

  G_variant_byteswap() can take a long time with some non-normal inputs

  A flaw was found in GLib. GVariant deserialization is vulnerable to a slowdown issue where a crafted GVariant can cause excessive processing, leading to denial of service.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Sep 14, 2023
• Medium 5.5
  CVE-2023-32665

  Gvariant deserialisation does not match spec for non-normal data

  A flaw was found in GLib. GVariant deserialization is vulnerable to an exponential blowup issue where a crafted GVariant can cause excessive processing, leading to denial of service.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Sep 14, 2023
• Medium 5.3
  CVE-2023-1672

  Race condition exists in the key generation and rotation functionality

  A race condition exists in the Tang server functionality for key generation and key rotation. This flaw results in a small time window where Tang private keys become readable by other processes on the same host.

  Red Hat Fedora Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Linux Debian Ubuntu Azure Linux
  Jul 11, 2023
• Medium 5.0
  CVE-2023-28101

  Flatpak metadata with ANSI control codes can cause misleading terminal output

  Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. In versions prior to 1.10.8, 1.12.8, 1.14.4, and 1.15.4, if an attacker publishes a Flatpak app with elevated permissions, they can hide those permissions fro…

  Flatpak Flatpak flatpak flatpak Debian Ubuntu
  Mar 16, 2023
• Medium 4.7
  CVE-2022-23527

  Open Redirect in oidc_validate_redirect_url()

  mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_valid…

  ZmartZone mod_auth_openidc libapache2-mod-auth-openidc libapache2-mod-auth-openidc Debian Ubuntu Azure Linux
  Dec 14, 2022
• Low 2.5
  CVE-2023-4016

  Under some circumstances, this weakness allows a user who has access to run the “ps” utility on a machine, the ability …

  Linux Linux Kernal procps procps Linux Debian Ubuntu Alpine
  Aug 2, 2023
• Unscored —
  CVE-2021-43618

  GNU Multiple Precision Arithmetic Library (GMP) through 6.2.1 has an mpz/inp_raw.c integer overflow and resultant buffe…

  gmp gmp gmp gmp Debian Ubuntu Azure Linux Alpine Wolfi
  Nov 15, 2021
• Unscored —
  CVE-2023-26767

  Buffer Overflow vulnerability found in Liblouis v.3.24.0 allows a remote attacker to cause a denial of service via the …

  liblouis liblouis liblouis Debian Ubuntu Azure Linux
  Mar 16, 2023
• Unscored —
  CVE-2023-26769

  Buffer Overflow vulnerability found in Liblouis Lou_Trace v.3.24.0 allows a remote attacker to cause a denial of servic…

  liblouis liblouis liblouis Debian Ubuntu Azure Linux
  Mar 16, 2023
• Unscored —
  CVE-2023-38710

  An issue was discovered in Libreswan before 4.12. When an IKEv2 Child SA REKEY packet contains an invalid IPsec protoco…

  libreswan libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  Aug 25, 2023
• Unscored —
  CVE-2023-38711

  An issue was discovered in Libreswan before 4.12. When an IKEv1 Quick Mode connection configured with ID_IPV4_ADDR or I…

  libreswan libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  Aug 25, 2023
• Unscored —
  CVE-2023-38712

  An issue was discovered in Libreswan 3.x and 4.x before 4.12. When an IKEv1 ISAKMP SA Informational Exchange packet con…

  libreswan libreswan libreswan libreswan Debian Ubuntu Azure Linux Alpine
  Aug 25, 2023

Revision history

1. 2026-11-08 #40

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

2. 2026-11-04 #39

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

3. 2026-10-13 #38

   Neue Updates von Oracle Linux aufgenommen

4. 2026-06-28 #37

   Neue Updates von Rocky Enterprise Software Foundation aufgenommen

5. 2026-06-08 #36

   Neue Updates von NetApp aufgenommen

6. 2026-02-22 #35

   Neue Updates von NetApp aufgenommen

7. 2026-01-04 #34

   Neue Updates von IBM aufgenommen

8. 2025-12-29 #33

   Neue Updates von SUSE aufgenommen

9. 2025-10-19 #32

   Neue Updates von Debian aufgenommen

10. 2025-03-02 #31

    Neue Updates von SUSE aufgenommen

11. 2025-02-12 #30

    Neue Updates von Ubuntu aufgenommen

12. 2025-02-04 #29

    Neue Updates von Red Hat aufgenommen

13. 2025-01-13 #28

    Neue Updates von Red Hat aufgenommen

14. 2024-12-03 #27

    Neue Updates von Red Hat aufgenommen

15. 2024-09-22 #26

    Neue Updates von Gentoo aufgenommen

16. 2024-08-11 #25

    Neue Updates von Gentoo aufgenommen

17. 2024-07-23 #24

    Neue Updates von Red Hat aufgenommen

18. 2024-07-18 #23

    Neue Updates von Red Hat aufgenommen

19. 2024-07-09 #22

    Neue Updates von Red Hat aufgenommen

20. 2024-06-11 #21

    Neue Updates von Red Hat aufgenommen

21. 2024-05-30 #20

    Neue Updates von Ubuntu aufgenommen

22. 2024-05-28 #19

    Neue Updates von Oracle Linux aufgenommen

23. 2024-05-21 #18

    Neue Updates von Red Hat aufgenommen

24. 2024-05-01 #17

    Neue Updates von Red Hat aufgenommen

25. 2024-04-25 #16

    Neue Updates von Red Hat aufgenommen

References

• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6343
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6365
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6371
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6385
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6492
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6518
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6523
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6549
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6542
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6551
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6566
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6569
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6621
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6631
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6661
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6685
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6705
• RedHatSecurity Advisory vom 2023-11-07
  https://access.redhat.com/errata/RHSA-2023:6712
• Red Hat Security Advisory RHSA-2023:7038 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7038
• Red Hat Security Advisory RHSA-2023:7187 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7187
• Red Hat Security Advisory RHSA-2023:6943 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:6943
• Red Hat Security Advisory RHSA-2023:7052 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7052
• Red Hat Security Advisory RHSA-2023:6940 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:6940
• Red Hat Security Advisory RHSA-2023:7057 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7057
• Red Hat Security Advisory RHSA-2023:6944 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:6944
• Red Hat Security Advisory RHSA-2023:7010 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7010
• Red Hat Security Advisory RHSA-2023:7174 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7174
• Red Hat Security Advisory RHSA-2023:7022 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7022
• Red Hat Security Advisory RHSA-2023:7166 vom 2023-11-15
  https://access.redhat.com/errata/RHSA-2023:7166
• Oracle Linux Security Advisory ELSA-2023-6712 vom 2023-11-16
  https://linux.oracle.com/errata/ELSA-2023-6712.html
• Oracle Linux Security Advisory ELSA-2023-6940 vom 2023-11-21
  https://linux.oracle.com/errata/ELSA-2023-6940.html
• Gentoo Linux Security Advisory GLSA-202311-18 vom 2023-11-27
  https://security.gentoo.org/glsa/202311-18
• Amazon Linux Security Advisory ALAS-2023-2362 vom 2023-12-05
  https://alas.aws.amazon.com/AL2/ALAS-2023-2362.html
• Red Hat Security Advisory RHSA-2023:7741 vom 2023-12-12
  https://access.redhat.com/errata/RHSA-2023:7741
• Red Hat Security Advisory RHSA-2023:7820 vom 2023-12-14
  https://access.redhat.com/errata/RHSA-2023:7820
• Oracle Linux Security Advisory ELSA-2024-0343 vom 2024-01-24
  https://linux.oracle.com/errata/ELSA-2024-0343.html
• Red Hat Security Advisory RHSA-2024:0343 vom 2024-01-24
  https://access.redhat.com/errata/RHSA-2024:0343
• Red Hat Security Advisory RHSA-2024:0406 vom 2024-01-25
  https://access.redhat.com/errata/RHSA-2024:0406
• Red Hat Security Advisory RHSA-2024:0422 vom 2024-01-25
  https://access.redhat.com/errata/RHSA-2024:0422
• CentOS Security Advisory CESA-2024:0343 vom 2024-01-26
  https://lists.centos.org/pipermail/centos-announce/2024-January/099213.html
• Red Hat Security Advisory RHSA-2024:0579 vom 2024-01-30
  https://access.redhat.com/errata/RHSA-2024:0579
• Meinberg Security Advisory
  https://www.meinberg.de/german/news/meinberg-security-advisory-mbgsa-2024-01-lantime-firmware-v7-08-007.htm
• Red Hat Security Advisory RHSA-2024:1102 vom 2024-03-05
  https://access.redhat.com/errata/RHSA-2024:1102
• Red Hat Security Advisory RHSA-2024:1412 vom 2024-03-19
  https://access.redhat.com/errata/RHSA-2024:1412
• Oracle Linux Security Advisory ELSA-2024-2033 vom 2024-04-25
  http://linux.oracle.com/errata/ELSA-2024-2033.html
• Red Hat Security Advisory RHSA-2024:2063 vom 2024-04-25
  https://access.redhat.com/errata/RHSA-2024:2063
• Red Hat Security Advisory RHSA-2024:2092 vom 2024-05-01
  https://access.redhat.com/errata/RHSA-2024:2092
• Red Hat Security Advisory RHSA-2024:2093 vom 2024-05-01
  https://access.redhat.com/errata/RHSA-2024:2093
• Red Hat Security Advisory RHSA-2024:2580 vom 2024-04-30
  https://access.redhat.com/errata/RHSA-2024:2580
• Red Hat Security Advisory RHSA-2024:2994 vom 2024-05-22
  https://access.redhat.com/errata/RHSA-2024:2994
• Red Hat Security Advisory RHSA-2024:3214 vom 2024-05-22
  https://access.redhat.com/errata/RHSA-2024:3214
• Oracle Linux Security Advisory ELSA-2024-2994 vom 2024-05-28
  https://linux.oracle.com/errata/ELSA-2024-2994.html
• Ubuntu Security Notice USN-6796-1 vom 2024-05-29
  https://ubuntu.com/security/notices/USN-6796-1
• Red Hat Security Advisory RHSA-2024:3812 vom 2024-06-11
  https://access.redhat.com/errata/RHSA-2024:3812
• Red Hat Security Advisory RHSA-2024:4408 vom 2024-07-09
  https://access.redhat.com/errata/RHSA-2024:4408
• Red Hat Security Advisory RHSA-2024:4430 vom 2024-07-09
  https://access.redhat.com/errata/RHSA-2024:4430
• Red Hat Security Advisory RHSA-2024:4631 vom 2024-07-18
  https://access.redhat.com/errata/RHSA-2024:4631
• Red Hat Security Advisory RHSA-2024:4739 vom 2024-07-23
  https://access.redhat.com/errata/RHSA-2024:4739
• Gentoo Linux Security Advisory GLSA-202408-33 vom 2024-08-12
  https://security.gentoo.org/glsa/202408-33
• Gentoo Linux Security Advisory GLSA-202409-18 vom 2024-09-22
  https://security.gentoo.org/glsa/202409-18
• Red Hat Security Advisory RHSA-2024:10761 vom 2024-12-03
  https://access.redhat.com/errata/RHSA-2024:10761
• Red Hat Security Advisory RHSA-2025:0309 vom 2025-01-14
  https://access.redhat.com/errata/RHSA-2025:0309
• Red Hat Security Advisory RHSA-2025:1013 vom 2025-02-04
  https://access.redhat.com/errata/RHSA-2025:1013
• Ubuntu Security Notice USN-7266-1 vom 2025-02-13
  https://ubuntu.com/security/notices/USN-7266-1
• SUSE Security Update SUSE-SU-2025:0741-1 vom 2025-02-28
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/UWWCXAWW252IRDVZWN2IV6HUZ37SPATI/
• Debian Security Advisory DLA-4336 vom 2025-10-17
  https://lists.debian.org/debian-lts-announce/2025/10/msg00017.html
• SUSE Security Update SUSE-SU-2025:4532-1 vom 2025-12-29
  https://lists.suse.com/pipermail/sle-security-updates/2025-December/023659.html
• SUSE Security Update SUSE-SU-2025:4532-1 vom 2025-12-29
  https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BBKJJQYVUC6MKZNDXGZERGROZTUYLEKW/
• IBM Security Bulletin 7256201 vom 2026-01-05
  https://www.ibm.com/support/pages/node/7256201
• NetApp Security Advisory NTAP-20241129-0011 vom 2026-02-20
  https://security.netapp.com/advisory/NTAP-20241129-0011
• NetApp Security Advisory NTAP-20240426-0006 vom 2026-06-08
  https://security.netapp.com/advisory/NTAP-20240426-0006
• Rocky Linux Security Advisory RLSA-2023:6712 vom 2026-06-26
  https://errata.build.resf.org/RLSA-2023:6712
• Oracle Linux Security Advisory ELSA-2026-35843 vom 2026-10-14
  https://linux.oracle.com/errata/ELSA-2026-35843.html
• Rocky Linux Security Advisory RLSA-2023:6940 vom 2026-11-05
  https://errata.build.resf.org/RLSA-2023:6940
• Rocky Linux Security Advisory RLSA-2023:7022 vom 2026-11-05
  https://errata.build.resf.org/RLSA-2023:7022
• Rocky Linux Security Advisory RLSA-2023:6944 vom 2026-11-08
  https://errata.build.resf.org/RLSA-2023:6944