Redhat Enterprise Linux For Power Little Endian vulnerabilities, page 4
110 vulnerabilities
Known vulnerabilities in Redhat Enterprise Linux For Power Little Endian, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
HighCVE-2024-9675chainguard · buildah +92 moreBuildah: buildah allows arbitrary directory mountA vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.EPSS0.39%MediumCVE-2024-9676debian · golang-github-containers-storage +34 morePodman: buildah: cri-o: symlink traversal vulnerability in the containers/storage library can cause denial of service (dos)A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.EPSS1.34%HighCVE-2024-6387almalinux +75 moreOpenssh: regresshion - race condition in ssh allows rce/dosA security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.EPSS99.51%HighCVE-2024-12088almalinux +23 moreRsync: --safe-links option bypass leads to path traversalA flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a path traversal vulnerability, which may lead to arbitrary file write outside the desired directory.EPSS4.65%HighCVE-2024-12085almalinux +28 moreRsync: info leak via uninitialized stack contentsA flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized memory and leak one byte of uninitialized stack data at a time.EPSS8.64%HighCVE-2024-12087almalinux +24 moreRsync: path traversal vulnerability in rsyncA path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly enabled by the client. When using the `--inc-recursive` option, a lack of proper symlink verification coupled with deduplication checks occurring on a per-file-list basis could allow a server to write files outside of the client's intended destination directory. A malicious server could write malicious files to arbitrary locations named after valid directories/paths on the client.EPSS2.26%HighCVE-2019-19906apache · bookkeeper +107 moreapache bookkeepercyrus-sasl (aka Cyrus SASL) 2.1.27 has an out-of-bounds write leading to unauthenticated remote denial-of-service in OpenLDAP via a malformed LDAP packet. The OpenLDAP crash is ultimately caused by an off-by-one error in _sasl_add_string in common.c in cyrus-sasl.EPSS8.04%CriticalCVE-2019-11043canonical · ubuntu_linux +179 moreUnderflow in PHP-FPM can lead to RCEIn PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI protocol data, thus opening the possibility of remote code execution.KEVRansomwareEPSS99.75%HighCVE-2019-0211apache · apache_http_server +30 moreapache apache_http_serverIn Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter) could execute arbitrary code with the privileges of the parent process (usually root) by manipulating the scoreboard. Non-Unix systems are not affected.KEVEPSS65.00%MediumCVE-2019-7317Alpine Linuxalpine · libpng +71 morealpine libpngpng_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.EPSS9.39%CriticalCVE-2019-5544ubuntu · openslp-dfsg +21 moreubuntu openslp-dfsgOpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base score of 9.8.KEVRansomwareEPSS98.13%MediumCVE-2019-15718debian · systemd +31 moredebian systemdIn systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access controls for incoming D-Bus messages. An unprivileged user can exploit this by executing D-Bus methods that should be restricted to privileged users, in order to change the system's DNS resolver settings.EPSS0.51%HighCVE-2019-6470Alpine Linuxalpine · dhcp +51 moredhcpd: use-after-free error leads crash in IPv6 mode when using mismatched BIND librariesThere had existed in one of the ISC BIND libraries a bug in a function that was used by dhcpd when operating in DHCPv6 mode. There was also a bug in dhcpd relating to the use of this function per its documentation, but the bug in the library function prevented this from causing any harm. All releases of dhcpd from ISC contain copies of this, and other, BIND libraries in combinations that have been tested prior to release and are known to not present issues like this. Some third-party packagers of ISC software have modified the dhcpd source, BIND source, or version matchup in ways that create the crash potential. Based on reports available to ISC, the crash probability is large and no analysis has been done on how, or even if, the probability can be manipulated by an attacker. Affects: Builds of dhcpd versions prior to version 4.4.1 when using BIND versions 9.11.2 or later, or BIND versions with specific bug fixes backported to them. ISC does not have access to comprehensive version lists for all repackagings of dhcpd that are vulnerable. In particular, builds from other vendors may also be affected. Operators are advised to consult their vendor documentation.EPSS8.81%MediumCVE-2019-6454canonical · ubuntu_linux +66 morecanonical ubuntu_linuxAn issue was discovered in sd-bus in systemd 239. bus_process_object() in libsystemd/sd-bus/bus-objects.c allocates a variable-length stack buffer for temporarily storing the object path of incoming D-Bus messages. An unprivileged local user can exploit this by sending a specially crafted message to PID1, causing the stack pointer to jump over the stack guard pages into an unmapped memory region and trigger a denial of service (systemd PID1 crash and kernel panic).EPSS2.04%HighCVE-2019-8383advancemame · advancecomp +8 moreadvancemame advancecompAn issue was discovered in AdvanceCOMP through 2.1. An invalid memory address occurs in the function adv_png_unfilter_8 in lib/png.c. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.EPSS1.25%HighCVE-2019-8720debian · webkit2gtk +27 moredebian webkit2gtkA vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.KEVEPSS1.56%HighCVE-2019-8379advancemame · advancecomp +7 moreadvancemame advancecompAn issue was discovered in AdvanceCOMP through 2.1. A NULL pointer dereference exists in the function be_uint32_read() located in endianrw.h. It can be triggered by sending a crafted file to a binary. It allows an attacker to cause a Denial of Service (Segmentation fault) or possibly have unspecified other impact when a victim opens a specially crafted file.EPSS1.25%MediumCVE-2026-59842chainguard · libssh +18 moreLibssh: libssh: information disclosure via short gssapi curve25519 public keyA flaw was found in libssh. During server-side GSSAPI key exchange, a client-supplied Curve25519 public key shorter than the expected length is copied without proper length validation, leading to an out-of-bounds heap read. This could allow a remote unauthenticated attacker to disclose small amounts of server memory.EPSS0.49%HighCVE-2026-59849chainguard · libssh +18 moreLibssh: libssh: denial of service via automatic certificate authentication loopA flaw was found in libssh. Logic errors in automatic certificate-based public key authentication can cause libssh clients to loop indefinitely when configured certificates are missing or repeatedly rejected by a server, leading to denial of service.EPSS0.44%CriticalCVE-2026-1709keylime +21 moreKeylime: keylime: authentication bypass allows unauthorized administrative operations due to missing client-side tls authenticationA flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated clients with network access to perform administrative operations, including listing agents, retrieving public Trusted Platform Module (TPM) data, and deleting agents, by connecting without presenting a client certificate.EPSS5.79%