Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
113 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2025-4948 | | Libsoup: integer underflow in soup_multipart_new_from_message() leading to denial of service in libsoup | HIGH 7.5 | 0.8 % | ||
| CVE-2025-46421 | | Libsoup: information disclosure may leads libsoup client sends authorization header to a different host when being redirected by a server | MEDIUM 6.8 | 0.6 % | ||
| CVE-2025-46420 | | Libsoup: memory leak on soup_header_parse_quality_list() via soup-headers.c | MEDIUM 6.5 | 0.6 % | ||
| CVE-2025-32911 | | Libsoup: double free on soup_message_headers_get_content_disposition() through "soup-message-headers.c" via "params" ghashtable value | CRITICAL 9.0 | 1.0 % | ||
| CVE-2025-32914 | | Libsoup: oob read on libsoup through function "soup_multipart_new_from_message" in soup-multipart.c leads to crash or exit of process | HIGH 7.4 | 0.8 % | ||
| CVE-2025-32907 | | Libsoup: denial of service in server when client requests a large amount of overlapping ranges with range header | MEDIUM 5.3 | 0.7 % | ||
| CVE-2025-32906 | | Libsoup: out of bounds reads in soup_headers_parse_request() | HIGH 7.5 | 1.0 % | ||
| CVE-2025-32913 | | Libsoup: null pointer dereference in soup_message_headers_get_content_disposition when "filename" parameter is present, but has no valu… | HIGH 7.5 | 0.8 % | ||
| CVE-2025-32053 | | Libsoup: heap buffer overflows in sniff_feed_or_html() and skip_insignificant_space() | MEDIUM 6.5 | 0.7 % | ||
| CVE-2025-32052 | | Libsoup: heap buffer overflow in sniff_unknown() | MEDIUM 6.5 | 0.7 % | ||
| CVE-2025-32050 | | Libsoup: integer overflow in append_param_quoted | MEDIUM 5.9 | 0.8 % | ||
| CVE-2025-32049 | | Libsoup: denial of service attack to websocket server | HIGH 7.5 | 0.9 % | ||
| CVE-2025-3155 | | Yelp: arbitrary file read | HIGH 7.4 | 13 % | ||
| CVE-2025-2784 | | Libsoup: heap buffer over-read in `skip_insignificant_space` when sniffing content | HIGH 7.0 | 0.9 % | ||
| CVE-2025-26601 | | Xorg: xwayland: use-after-free in syncinittrigger() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26600 | | Xorg: xwayland: use-after-free in playreleasedevents() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26599 | | Xorg: xwayland: use of uninitialized pointer in compredirectwindow() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26598 | | Xorg: xwayland: out-of-bounds write in createpointerbarrierclient() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26597 | | Xorg: xwayland: buffer overflow in xkbchangetypesofkey() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26596 | | Xorg: xwayland: heap overflow in xkbwritekeysyms() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26595 | | Xorg: xwayland: buffer overflow in xkbvmodmasktext() | HIGH 7.8 | 0.4 % | ||
| CVE-2025-26594 | | X.org: xwayland: use-after-free of the root cursor | HIGH 7.8 | 0.4 % | ||
| CVE-2025-0624 | | Grub2: net: out-of-bounds write in grub_net_search_config_file() | HIGH 7.6 | 1.4 % | ||
| CVE-2025-1244 | | Emacs: shell injection vulnerability in gnu emacs via custom "man" uri scheme | HIGH 8.8 | 2.6 % | ||
| CVE-2024-11218 | | Podman: buildah: container breakout by using --jobs=2 and a race condition when building a malicious containerfile | HIGH 8.6 | 0.4 % | ||
| CVE-2024-12085 | | Rsync: info leak via uninitialized stack contents | HIGH 7.5 | 8.6 % | ||
| CVE-2024-11614 | | Dpdk: denial of service from malicious guest on hypervisors using dpdk vhost library | HIGH 7.4 | 0.6 % | ||
| CVE-2024-52337 | | Tuned: improper sanitization of `instance_name` parameter of the `instance_create()` method | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-9632 | | Xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability | HIGH 7.8 | 0.9 % | ||
| CVE-2024-9050 | | Networkmanager-libreswan: local privilege escalation via leftupdown | HIGH 7.8 | 0.5 % | ||
| CVE-2024-9675 | | Buildah: buildah allows arbitrary directory mount | HIGH 7.8 | 0.4 % | ||
| CVE-2024-45770 | | Pcp: pmpost symlink attack allows escalating pcp to root user | MEDIUM 4.4 | 0.3 % | ||
| CVE-2024-45769 | | Pcp: pmcd heap corruption through metric pmstore operations | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-7006 | fixed in 0:4.4.0-8.el9_2.1 | Libtiff: null pointer dereference in tif_dirinfo.c | HIGH 7.5 | 1.5 % | ||
| CVE-2024-7409 | fixed in 17:7.2.0-14.el9_2.14 | Qemu: denial of service via improper synchronization in qemu nbd server during socket closure | HIGH 7.5 | 1.0 % | ||
| CVE-2024-6409 | fixed in 0:8.7p1-30.el9_2.7 | Openssh: possible remote code execution due to a race condition in signal handling affecting red hat enterprise linux 9 | HIGH 7.0 | 28 % | ||
| CVE-2024-4467 | | Qemu-kvm: 'qemu-img info' leads to host file read/write | HIGH 7.8 | 0.3 % | ||
| CVE-2024-6387 | fixed in 0:8.7p1-30.el9_2.4 | Openssh: regresshion - race condition in ssh allows rce/dos | HIGH 8.1 | 100 % | ||
| CVE-2024-5953 | | 389-ds-base: malformed userpassword hash may cause denial of service | MEDIUM 5.7 | 0.6 % | ||
| CVE-2024-3183 | | Freeipa: user can obtain a hash of the passwords of all domain users and perform offline brute force | HIGH 8.1 | 2.1 % | ||
| CVE-2024-2698 | fixed in 0:4.10.1-12.el9_2.2 | Freeipa: delegation rules allow a proxy service to impersonate any user to access another target service | HIGH 8.8 | 0.7 % | ||
| CVE-2023-4727 | | Ca: token authentication bypass vulnerability | HIGH 7.5 | 0.7 % | ||
| CVE-2024-3049 | | Booth: specially crafted hash can lead to invalid hmac being accepted by booth server | MEDIUM 5.9 | 0.5 % | ||
| CVE-2024-5564 | | Libndp: buffer overflow in route information length field | HIGH 8.1 | 1.2 % | ||
| CVE-2024-3657 | | 389-ds-base: potential denial of service via specially crafted kerberos as-req request | HIGH 7.5 | 1.3 % | ||
| CVE-2024-2199 | | 389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c | MEDIUM 5.7 | 0.6 % | ||
| CVE-2024-4418 | fixed in 0:9.0.0-10.7.el9_2 | Libvirt: stack use-after-free in virnetclientioeventloop() | MEDIUM 6.2 | 0.5 % | ||
| CVE-2024-2905 | fixed in 0:2023.3-2.el9_2 | Rpm-ostree: world-readable /etc/shadow file | MEDIUM 6.2 | 0.3 % | ||
| CVE-2023-3758 | | Sssd: race condition during authorization leads to gpo policies functioning inconsistently | HIGH 7.1 | 1.0 % | ||
| CVE-2024-31083 | | Xorg-x11-server: use-after-free in procrenderaddglyphs | HIGH 7.8 | 1.9 % | ||
| CVE-2024-31081 | | Xorg-x11-server: heap buffer overread/data leakage in procxipassivegrabdevice | HIGH 7.3 | 0.5 % | ||
| CVE-2024-31080 | | Xorg-x11-server: heap buffer overread/data leakage in procxigetselectedevents | HIGH 7.3 | 0.5 % | ||
| CVE-2024-3019 | | Pcp: exposure of the redis server backend allows remote command execution via pmproxy | HIGH 8.8 | 1.1 % | ||
| CVE-2024-28834 | | Gnutls: vulnerable to minerva side-channel information leak | MEDIUM 5.3 | 0.7 % | ||
| CVE-2024-1394 | | Golang-fips/openssl: memory leaks in code encrypting and decrypting rsa payloads | HIGH 7.5 | 1.5 % | ||
| CVE-2024-28835 | | Gnutls: potential crash during chain building/verification | MEDIUM 5.0 | 0.4 % | ||
| CVE-2024-1753 | | Buildah: buildah: container escape via improper bind mount validation | HIGH 8.6 | 0.5 % | ||
| CVE-2024-2236 | fixed in 0:1.10.0-10.el9_2.1 | Libgcrypt: vulnerable to marvin attack | MEDIUM 5.9 | 1.1 % | ||
| CVE-2024-21886 | | Xorg-x11-server: heap buffer overflow in disabledevice | HIGH 7.8 | 1.4 % | ||
| CVE-2024-21885 | | Xorg-x11-server: heap buffer overflow in xisenddevicehierarchyevent | HIGH 7.8 | 1.4 % | ||
| CVE-2024-1488 | | Unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation | HIGH 8.0 | 0.3 % | ||
| CVE-2024-1062 | | 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr) | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-1151 | fixed in 0:5.14.0-284.75.1.el9_2 | Kernel: stack overflow problem in open vswitch kernel module leading to dos | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-0229 | | Xorg-x11-server: reattaching to different master device may lead to out-of-bounds memory access | HIGH 7.8 | 1.2 % | ||
| CVE-2023-6536 | | Kernel: null pointer dereference in __nvmet_req_complete | HIGH 7.5 | 1.5 % | ||
| CVE-2023-6535 | | Kernel: null pointer dereference in nvmet_tcp_execute_request | HIGH 7.5 | 1.5 % | ||
| CVE-2023-6356 | | Kernel: null pointer dereference in nvmet_tcp_build_iovec | HIGH 7.5 | 1.5 % | ||
| CVE-2023-6240 | | Kernel: marvin vulnerability side-channel leakage in the rsa decryption operation | MEDIUM 6.5 | 1.0 % | ||
| CVE-2024-0914 | | Opencryptoki: timing side-channel in handling of rsa pkcs#1 v1.5 padded ciphertexts (marvin) | MEDIUM 5.9 | 0.9 % | ||
| CVE-2023-40551 | | Shim: out of bounds read when parsing mz binaries | MEDIUM 5.1 | 0.4 % | ||
| CVE-2023-40549 | | Shim: out-of-bounds read in verify_buffer_authenticode() malformed pe file | MEDIUM 6.2 | 0.4 % | ||
| CVE-2023-40546 | | Shim: out-of-bounds read printing error messages | MEDIUM 6.2 | 0.4 % | ||
| CVE-2023-40550 | | Shim: out-of-bound read in verify_buffer_sbat() | MEDIUM 5.5 | 0.4 % | ||
| CVE-2023-40548 | | Shim: interger overflow leads to heap buffer overflow in verify_sbat_section on 32-bits systems | HIGH 7.4 | 0.4 % | ||
| CVE-2023-40547 | | Shim: rce in http boot support may lead to secure boot bypass | HIGH 8.3 | 5.4 % | ||
| CVE-2023-6816 | | Xorg-x11-server: heap buffer overflow in devicefocusevent and procxiquerypointer | CRITICAL 9.8 | 2.1 % | ||
| CVE-2024-0646 | | Kernel: ktls overwrites readonly memory pages when using function splice with a ktls socket as destination | HIGH 7.8 | 0.3 % | ||
| CVE-2024-0567 | fixed in 0:3.7.6-21.el9_2.2 | Gnutls: rejects certificate chain with distributed trust | HIGH 7.5 | 1.4 % | ||
| CVE-2024-0553 | | Gnutls: incomplete fix for cve-2023-5981 | HIGH 7.5 | 1.6 % | ||
| CVE-2024-0565 | | Kernel: cifs filesystem decryption improper input validation remote code execution vulnerability in function receive_encrypted_standard o… | HIGH 7.4 | 2.0 % | ||
| CVE-2023-4001 | fixed in 1:2.06-61.el9_2.2 | Grub2: bypass the grub password protection feature | MEDIUM 6.8 | 0.5 % | ||
| CVE-2024-0443 | fixed in 0:5.14.0-284.40.1.el9_2 | Kernel: blkio memory leakage due to blkcg and some blkgs are not freed after they are made offline. | MEDIUM 5.5 | 0.2 % | ||
| CVE-2023-5455 | | Ipa: invalid csrf protection | MEDIUM 6.5 | 0.6 % | ||
| CVE-2023-7192 | | Kernel: refcount leak in ctnetlink_create_conntrack() | MEDIUM 5.5 | 0.3 % | ||
| CVE-2024-0193 | | Kernel: netfilter: use-after-free in nft_trans_gc_catchall_sync leads to privilege escalation | HIGH 7.8 | 0.8 % | ||
| CVE-2023-6546 | | Kernel: gsm multiplexing race condition leads to privilege escalation | HIGH 7.0 | 0.7 % | ||
| CVE-2023-6478 | | Xorg-x11-server: out-of-bounds memory read in rrchangeoutputproperty and rrchangeproviderproperty | HIGH 7.6 | 1.6 % | ||
| CVE-2023-6377 | | Xorg-x11-server: out-of-bounds memory reads/writes in xkb button actions | HIGH 7.8 | 1.6 % | ||
| CVE-2023-6679 | fixed in 0:5.14.0-284.48.1.el9_2 | Kernel: null pointer dereference in dpll_pin_parent_pin_set() in drivers/dpll/dpll_netlink.c | MEDIUM 5.5 | 0.3 % | ||
| CVE-2023-5870 | | Postgresql: role pg_signal_backend can signal certain superuser processes. | MEDIUM 4.4 | 2.6 % | ||
| CVE-2023-5869 | | Postgresql: buffer overrun from integer overflow in array modification | HIGH 8.8 | 4.3 % | ||
| CVE-2023-5868 | | Postgresql: memory disclosure in aggregate function calls | MEDIUM 4.3 | 2.8 % | ||
| CVE-2023-6610 | | Kernel: oob access in smb2_dump_detail | HIGH 7.1 | 0.4 % | ||
| CVE-2023-6606 | | Kernel: out-of-bounds read vulnerability in smbcalcsize | HIGH 7.1 | 0.5 % | ||
| CVE-2023-5981 | | Gnutls: timing side-channel in the rsa-psk authentication | MEDIUM 5.9 | 1.3 % | ||
| CVE-2023-5090 | fixed in 0:5.14.0-284.69.1.el9_2 | Kernel: kvm: svm: improper check in svm_set_x2apic_msr_interception allows direct access to host x2apic msrs | MEDIUM 6.0 | 0.2 % | ||
| CVE-2023-42669 | | Samba: "rpcecho" development server allows denial of service via sleep() call on ad dc | MEDIUM 6.5 | 1.9 % | ||
| CVE-2023-3961 | | Samba: smbd allows client access to unix domain sockets on the file system as root | CRITICAL 9.8 | 2.7 % | ||
| CVE-2023-5824 | | Squid: dos against http and https | HIGH 7.5 | 3.3 % | ||
| CVE-2023-4091 | | Samba: smb clients can truncate files with read-only permissions | MEDIUM 6.5 | 1.3 % | ||
| CVE-2023-5178 | | Kernel: use after free in nvmet_tcp_free_crypto in nvme | HIGH 8.8 | 9.6 % | ||
| CVE-2023-5367 | | Xorg-x11-server: out-of-bounds write in xichangedeviceproperty/rrchangeoutputproperty | HIGH 7.8 | 0.6 % | ||
| CVE-2023-5633 | | Kernel: vmwgfx: reference count issue leads to use-after-free in surface handling | HIGH 7.8 | 0.3 % | ||
| CVE-2023-5557 | | Tracker-miners: sandbox escape | HIGH 7.7 | 0.8 % | ||
| CVE-2023-39191 | fixed in 0:5.14.0-284.48.1.el9_2 | Kernel: ebpf: insufficient stack type checks in dynptr | HIGH 8.2 | 0.5 % | ||
| CVE-2023-42753 | | Kernel: netfilter: potential slab-out-of-bound access due to integer underflow | HIGH 7.8 | 0.5 % | ||
| CVE-2023-39418 | fixed in 9020020231115020618.rhel9 | Postgresql: merge fails to enforce update or select row security policies | MEDIUM 4.3 | 1.1 % | ||
| CVE-2023-39417 | | Postgresql: extension script @substitutions@ within quoting allow sql injection | HIGH 8.8 | 1.7 % | ||
| CVE-2023-33951 | | Kernel: vmwgfx: race condition leading to information disclosure vulnerability | MEDIUM 6.7 | 0.3 % | ||
| CVE-2023-3812 | | Kernel: tun: bugs for oversize packet when napi frags enabled in tun_napi_alloc_frags | HIGH 7.8 | 0.3 % | ||
| CVE-2023-3567 | | Kernel: use after free in vcs_read in drivers/tty/vt/vc_screen.c due to race | HIGH 7.1 | 0.4 % | ||
| CVE-2023-33952 | | Kernel: vmwgfx: double free within the handling of vmw_buffer_object objects | MEDIUM 6.7 | 0.5 % | ||
| CVE-2023-34966 | | Samba: infinite loop in mdssvc rpc service for spotlight | HIGH 7.5 | 62 % |