Skip to content
OpenAdvisories
High WID-SEC-2026-4187 6 CVEs

Red Hat Enterprise Linux (libXi, libXrender, ansible-collection-redhat-leapp) und Red Hat Build of Apache Camel for Quarkus: Mehrere Schwachstellen

Published Oct 27, 2026 · Updated Nov 12, 2026 · Revision 11 · de

Vendor: Apache Vendor: OpenBSD Vendor: Oracle Vendor: Red Hat Vendor: RESF Vendor: SUSE Product: Camel Product: Enterprise Linux Product: Linux Product: Linux Product: OpenBSD Product: Rocky Linux Platform: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux und Red Hat Build of Apache Camel for Quarkus ausnutzen, um einen Denial of Service Angriff durchzuführen, Sicherheitsmaßnahmen zu umgehen, beliebigen Code auszuführen sowie Daten offenzulegen oder zu manipulieren.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.
Apache Camel ist ein Integrations-Framework, das Enterprise Integration Patterns implementiert.

Vulnerabilities 6

  • Critical 9.8
    CVE-2026-110879

    jackson-databind: PolymorphicTypeValidator bypass via generic type arguments and array element types allows arbitrary class instantiation (incomplete fix for CVE-2026-54512)

    jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argumen…

    FasterXML jackson-databind jackson-databind jackson-databind Debian Ubuntu
  • High 8.9
    CVE-2026-88807

    libXrender RenderQueryPictFormats Reply Heap-based Buffer Overflow

    A heap overflow in libXrender before 0.9.13 in RenderQueryPictFormats could be used by malicious X servers to inject code into attached X clients.

    X.Org libXrender libxrender libxrender Debian Ubuntu Azure Linux Alpine
  • High 7.4
    CVE-2026-93543

    Out-of-bounds read in libXi's XI2 class parser

    An out-of-bounds read in libXi's XI2 class parser in libXi before 1.8.4 could be used by malicious X servers to crash an attached X client.

    X.Org libXi libxi libxi Debian Ubuntu Azure Linux Alpine
  • High 7.1
    CVE-2026-94286

    Out-of-bounds read in libXtst's RECORD reply parser

    An out-of-bounds read in libXtst's RECORD reply parser in libXtst before 1.2.6 could be used by malicious X servers to crash attached X clients.

    X.Org libXtst libxtst libxtst Debian Ubuntu Azure Linux Alpine
  • Medium 6.2
    CVE-2026-68562

    Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering

    A flaw was found in ansible-collection-redhat-leapp. An attacker with privileged write access to a managed node's Leapp report content can manipulate it. When an operator runs a specific remediation task, this manipulated report can cause the Ansible controll…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Linux
  • Medium 5.5
    CVE-2026-68563

    Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions

    A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the `leapp_old_postgresql_data` option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a loca…

    Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 10 Linux

Revision history

  1. #11

    Neue Updates von Rocky Enterprise Software Foundation, SUSE und Red Hat aufgenommen

  2. #10

    Neue Updates von Red Hat und Rocky Enterprise Software Foundation aufgenommen

  3. #9

    Neue Updates von Zero Day Initiative und SUSE aufgenommen

  4. #8

    Neue Updates von SUSE aufgenommen

  5. #7

    Neue Updates aufgenommen

  6. #6

    Neue Updates von Red Hat aufgenommen

  7. #5

    Neue Updates von Red Hat aufgenommen

  8. #4

    Neue Updates von Red Hat aufgenommen

  9. #3

    Neue Updates von Rocky Enterprise Software Foundation und Oracle Linux aufgenommen

  10. #2

    Neue Updates von Oracle Linux und Red Hat aufgenommen

  11. #1

    Initiale Fassung

References