Red Hat Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions
102 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-4802 | | Cockpit: cockpit: arbitrary command execution via crafted links in system logs ui | HIGH 8.0 | 1.0 % | ||
| CVE-2026-34002 | | Xorg: xwayland: x.org x server: information disclosure or denial of service via out-of-bounds read in xkb modifier map handling | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-34000 | | Xwayland: xorg: x.org x server: information disclosure and denial of service via out-of-bounds read in xkb geometry processing. | CRITICAL 9.1 | 0.5 % | ||
| CVE-2026-34003 | | Xorg: xwayland: x.org x server: information exposure and denial of service via out-of-bounds memory access | HIGH 7.8 | 0.3 % | ||
| CVE-2026-34001 | | Xorg: xwayland: x.org x server: use-after-free vulnerability leads to server crash and potential memory corruption | HIGH 7.8 | 0.3 % | ||
| CVE-2026-33999 | | Xorg: xwayland: x.org x server: denial of service via integer underflow in xkb compatibility map handling | HIGH 7.8 | 0.4 % | ||
| CVE-2026-35092 | | Corosync: corosync: denial of service via integer overflow in join message validation | HIGH 7.5 | 1.0 % | ||
| CVE-2026-35091 | | Corosync: corosync: denial of service and information disclosure via crafted udp packet | HIGH 8.2 | 0.9 % | ||
| CVE-2026-5201 | | Gdk-pixbuf: gdk-pixbuf: denial of service via heap-based buffer overflow when processing a specially crafted jpeg image | HIGH 7.5 | 1.1 % | ||
| CVE-2026-5121 | | Libarchive: libarchive: arbitrary code execution via integer overflow in iso9660 image processing | CRITICAL 9.8 | 1.1 % | ||
| CVE-2026-5119 | | Libsoup: libsoup: information disclosure via cleartext transmission of cookies during https tunnel establishment | HIGH 8.2 | 0.3 % | ||
| CVE-2026-4887 | | Gimp: gimp:memory disclosure and denial of service via specially crafted pcx image | HIGH 7.1 | 0.6 % | ||
| CVE-2026-4775 | | Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing | HIGH 7.8 | 0.6 % | ||
| CVE-2026-4424 | | Libarchive: libarchive: information disclosure via heap out-of-bounds read in rar archive processing | HIGH 7.5 | 1.3 % | ||
| CVE-2026-4111 | fixed in 0:3.5.3-2.el9_0.3 | Libarchive: infinite loop denial of service in rar5 decompression via archive_read_data() in libarchive | HIGH 7.5 | 0.7 % | ||
| CVE-2025-14905 | | 389-ds-base: 389-ds-base: remote code execution and denial of service via heap buffer overflow | HIGH 7.2 | 1.3 % | ||
| CVE-2026-1761 | | Libsoup: stack-based buffer overflow in libsoup multipart response parsingmultipart http response | HIGH 8.6 | 1.1 % | ||
| CVE-2025-14242 | | Vsftpd: vsftpd: denial of service via integer overflow in ls command parameter parsing | MEDIUM 6.5 | 0.8 % | ||
| CVE-2026-0719 | | Libsoup: signed to unsigned conversion error leading to stack-based buffer overflow in libsoup ntlm authentication | HIGH 8.6 | 0.6 % | ||
| CVE-2025-14523 | | Libsoup: libsoup: duplicate host header handling causes host-parsing discrepancy (first- vs last-value wins) | HIGH 8.2 | 0.5 % | ||
| CVE-2025-14512 | | Glib: integer overflow in glib gio attribute escaping causes heap buffer overflow | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-14087 | | Glib: glib: buffer underflow in gvariant parser leads to heap corruption | CRITICAL 9.8 | 0.8 % | ||
| CVE-2025-66287 | | Webkitgtk: processing maliciously crafted web content may lead to an unexpected process crash | HIGH 8.8 | 0.5 % | ||
| CVE-2025-13947 | | Webkit: webkitgtk: remote user-assisted information disclosure via file drag-and-drop | HIGH 7.4 | 0.3 % | ||
| CVE-2025-13601 | | Glib: integer overflow in in g_escape_uri_string() | HIGH 7.7 | 0.3 % | ||
| CVE-2025-13502 | | Webkit: webkitgtk / wpe webkit: out-of-bounds read and integer underflow vulnerability leading to dos | HIGH 7.5 | 0.6 % | ||
| CVE-2025-61662 | | Grub2: missing unregister call for gettext command may lead to use-after-free | HIGH 7.8 | 0.2 % | ||
| CVE-2025-59089 | | Python-kdcproxy: remote dos via unbounded tcp upstream buffering | MEDIUM 5.9 | 0.6 % | ||
| CVE-2025-59088 | | Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv | HIGH 8.6 | 0.5 % | ||
| CVE-2025-62229 | | Xorg: xmayland: use-after-free in xpresentnotify structure creation | HIGH 7.3 | 0.5 % | ||
| CVE-2025-62230 | | Xorg: xwayland: use-after-free in xkb client resource removal | HIGH 7.3 | 0.3 % | ||
| CVE-2025-62231 | | Xorg: xmayland: value overflow in xkbsetcompatmap() | HIGH 7.3 | 0.3 % | ||
| CVE-2025-11561 | | Sssd: sssd default kerberos configuration allows privilege escalation on ad-joined linux systems | HIGH 8.8 | 0.8 % | ||
| CVE-2025-11234 | | Qemu-kvm: vnc websocket handshake use-after-free | HIGH 7.5 | 0.9 % | ||
| CVE-2025-7493 | | Freeipa: idm: privilege escalation from host to domain admin in freeipa | CRITICAL 9.1 | 0.6 % | ||
| CVE-2025-11021 | | Libsoup: out-of-bounds read in cookie date handling of libsoup http library | HIGH 7.5 | 0.6 % | ||
| CVE-2025-9900 | | Libtiff: libtiff write-what-where | HIGH 8.8 | 1.0 % | ||
| CVE-2025-9566 | | Podman: podman kube play command may overwrite host files | HIGH 8.1 | 1.2 % | ||
| CVE-2025-8067 | | Udisks: out-of-bounds read in udisks daemon | HIGH 8.5 | 0.7 % | ||
| CVE-2025-8941 | | Linux-pam: incomplete fix for cve-2025-6020 | HIGH 7.8 | 0.3 % | ||
| CVE-2025-7425 | | Libxslt: libxml2: heap use-after-free in libxslt caused by atype corruption in xmlattrptr | HIGH 7.8 | 0.4 % | ||
| CVE-2025-7345 | | Gdk‑pixbuf: heap‑buffer‑overflow in gdk‑pixbuf | HIGH 7.5 | 1.3 % | ||
| CVE-2025-5372 | | Libssh: incorrect return code handling in ssh_kdf() in libssh | HIGH 8.8 | 0.5 % | ||
| CVE-2025-5318 | | Libssh: out-of-bounds read in sftp_handle() | HIGH 8.1 | 1.9 % | ||
| CVE-2025-6019 | | Libblockdev: lpe from allow_active to root in libblockdev via udisks | HIGH 7.0 | 0.5 % | ||
| CVE-2025-49180 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x resize, rotate and reflect (randr) extension | HIGH 7.8 | 0.3 % | ||
| CVE-2025-49179 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in x record extension | HIGH 7.3 | 0.3 % | ||
| CVE-2025-49178 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: unprocessed client request due to bytes to ignore | MEDIUM 5.5 | 0.2 % | ||
| CVE-2025-49176 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: integer overflow in big requests extension | HIGH 7.3 | 0.4 % | ||
| CVE-2025-49175 | | Xorg-x11-server-xwayland: xorg-x11-server: tigervnc: out-of-bounds read in x rendering extension animated cursors | MEDIUM 6.1 | 0.3 % | ||
| CVE-2025-4404 | | Freeipa: idm: privilege escalation from host to domain admin in freeipa | CRITICAL 9.1 | 2.0 % | ||
| CVE-2025-6020 | | Linux-pam: linux-pam directory traversal | HIGH 7.8 | 0.5 % | ||
| CVE-2025-49794 | | Libxml: heap use after free (uaf) leads to denial of service (dos) | CRITICAL 9.1 | 0.8 % | ||
| CVE-2025-49796 | | Libxml: type confusion leads to denial of service (dos) | CRITICAL 9.1 | 1.6 % | ||
| CVE-2025-6021 | | Libxml2: integer overflow in xmlbuildqname() leads to stack buffer overflow in libxml2 | HIGH 7.5 | 1.4 % | ||
| CVE-2025-5914 | | Libarchive: double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c | HIGH 7.8 | 0.5 % | ||
| CVE-2025-5222 | fixed in 0:67.1-10.el9_0 | Icu: stack buffer overflow in the srbroot::addtag function | HIGH 7.0 | 0.4 % | ||
| CVE-2025-48798 | | Gimp: multiple use after free in xcf parser | HIGH 7.3 | 0.2 % | ||
| CVE-2025-48797 | | Gimp: multiple heap buffer overflows in tga parser | HIGH 7.3 | 0.3 % | ||
| CVE-2025-5024 | | Gnome-remote-desktop: uncontrolled resource consumption due to malformed rdp pdus | HIGH 7.4 | 0.8 % | ||
| CVE-2025-4945 | | Libsoup: integer overflow in cookie expiration date handling in libsoup | LOW 3.7 | 0.7 % | ||
| CVE-2025-4948 | | Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup | HIGH 7.5 | 0.8 % | ||
| CVE-2025-4373 | | Glib: buffer underflow on glib through glib/gstring.c via function g_string_insert_unichar | MEDIUM 4.8 | 0.6 % | ||
| CVE-2025-3891 | | Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled | HIGH 7.5 | 1.6 % | ||
| CVE-2025-46421 | | Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server | MEDIUM 6.8 | 0.6 % | ||
| CVE-2025-46420 | | Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-32911 | | Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value | CRITICAL 9.0 | 1.0 % | ||
| CVE-2025-3576 | | Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-32914 | | Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process | HIGH 7.4 | 0.8 % | ||
| CVE-2025-32907 | | Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header | MEDIUM 5.3 | 0.7 % | ||
| CVE-2025-32906 | | Libsoup: out of bounds reads in soup_headers_parse_request() | HIGH 7.5 | 1.0 % | ||
| CVE-2025-32913 | | Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no valu… | HIGH 7.5 | 0.8 % | ||
| CVE-2025-32049 | | Libsoup: denial of service attack to websocket server | HIGH 7.5 | 0.9 % | ||
| CVE-2025-3155 | | Yelp: arbitrary file read | HIGH 7.4 | 13 % | ||
| CVE-2025-2784 | | Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content | HIGH 7.0 | 0.9 % | ||
| CVE-2024-8176 | | Libexpat: expat: improper restriction of xml entity expansion depth in libexpat | HIGH 7.5 | 1.4 % | ||
| CVE-2025-26601 | | Xorg: xwayland: use-after-free in syncinittrigger() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26600 | | Xorg: xwayland: use-after-free in playreleasedevents() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26599 | | Xorg: xwayland: use of uninitialized pointer in compredirectwindow() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26598 | | Xorg: xwayland: out-of-bounds write in createpointerbarrierclient() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26597 | | Xorg: xwayland: buffer overflow in xkbchangetypesofkey() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26596 | | Xorg: xwayland: heap overflow in xkbwritekeysyms() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26595 | | Xorg: xwayland: buffer overflow in xkbvmodmasktext() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26594 | | X.org: xwayland: use-after-free of the root cursor | HIGH 7.8 | 0.4 % | ||
| CVE-2025-0624 | | Grub2: net: out-of-bounds write in grub_net_search_config_file() | HIGH 7.6 | 1.4 % | ||
| CVE-2025-1244 | | Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme | HIGH 8.8 | 2.6 % | ||
| CVE-2024-11218 | | Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile | HIGH 8.6 | 0.4 % | ||
| CVE-2024-12087 | | Rsync: path traversal vulnerability in rsync | HIGH 7.5 | 2.3 % | ||
| CVE-2024-12085 | | Rsync: info leak via uninitialized stack contents | HIGH 7.5 | 8.6 % | ||
| CVE-2024-11614 | | Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library | HIGH 7.4 | 0.6 % | ||
| CVE-2024-9632 | | Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability | HIGH 7.8 | 0.9 % | ||
| CVE-2024-9050 | | Networkmanager-libreswan: local privilege escalation via leftupdown | HIGH 7.8 | 0.5 % | ||
| CVE-2024-45770 | | Pcp: pmpost symlink attack allows escalating pcp to root user | MEDIUM 4.4 | 0.3 % | ||
| CVE-2024-45769 | | Pcp: pmcd heap corruption through metric pmstore operations | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-6409 | fixed in 0:8.7p1-12.el9_0.3 | Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9 | HIGH 7.0 | 28 % | ||
| CVE-2024-4467 | | Qemu-kvm: 'qemu-img info' leads to host file read/write | HIGH 7.8 | 0.3 % | ||
| CVE-2024-6387 | fixed in 0:8.7p1-12.el9_0.1 | Openssh: regresshion - race condition in ssh allows rce/dos | HIGH 8.1 | 100 % | ||
| CVE-2023-4727 | | Ca: token authentication bypass vulnerability | HIGH 7.5 | 0.7 % | ||
| CVE-2024-3049 | | Booth: specially crafted hash can lead to invalid hmac being accepted by booth server | MEDIUM 5.9 | 0.5 % | ||
| CVE-2024-5564 | | Libndp: buffer overflow in route information length field | HIGH 8.1 | 1.2 % | ||
| CVE-2024-1394 | | Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads | HIGH 7.5 | 1.5 % | ||
| CVE-2024-0193 | fixed in 0:5.14.0-70.105.1.el9_0 | Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation | HIGH 7.8 | 0.8 % |