Multiple security vulnerabilities have been identified in the Hewlett-Packard Linux Imaging and Printing Project (HPLIP) packages used in Red Hat Enterprise Linux 9. These include issues that could lead to remote code execution, local code execution, privilege escalation, and denial of service. The vulnerabilities involve heap-based buffer overflows and improper use of cryptographic keys. Red Hat has released an important security update addressing these issues along with bug fixes and enhancements.
Multiple security vulnerabilities were discovered in curl affecting various features including GnuTLS WebSocket handling, AWS SigV4 authentication state, SSH host verification, cookie handling, HTTP proxy authentication, HSTS processing, IMAP command injection, FTP wildcard matching, TFTP transfer validation, file overwrite protection, MIME processing, and HTTP/2 upload handling. These issues could allow attackers to obtain sensitive information, cause denial of service, perform machine-in-the-middle attacks, overwrite local files, or execute arbitrary code. The vulnerabilities are addressed in updated curl packages.
A vulnerability in libcurl allows a malicious FTP, IMAP, POP3, or SMTP server to bypass the configured transfer timeout by permanently omitting the final control-response line. This flaw causes libcurl to indefinitely block all concurrent transfers bound to the same multi-handle. The issue affects specific Ubuntu package versions of curl and has been assigned CVE-2026-92387 with a high severity rating and a CVSS score of 8.1. Fixes are available in Ubuntu package versions 8.20.0-2ubuntu11.1 and 8.18.0-1ubuntu2.8.
A vulnerability in curl allows a remote HTTP server to set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On subsequent curl invocations using the same cookie and cookie-jar paths, curl fails before connecting and replaces the cookie jar with an empty file, deleting cookies for unrelated domains. This issue affects multiple Ubuntu package versions of curl and has been fixed in later releases.
A vulnerability (CVE-2026-76151) exists in the QtNetwork module of the Qt Framework used in Red Hat Hardened Images. It is an out-of-bounds read flaw triggered by processing an excessively large HTTP Cache-Control header from a remote server, causing a denial of service (application crash). This affects only client-side applications using QNetworkAccessManager and does not allow information disclosure or code execution. Red Hat Enterprise Linux 8 and 9 are not affected as they use Qt 5, which lacks the vulnerable code. A security update with fixed RPM packages is available.
A vulnerability in the Qt XML component (QDom) allows improper output neutralization during serialization of comments, CDATA, and processing instructions. This flaw can enable an attacker to inject arbitrary XML markup, potentially compromising data integrity. The issue is addressed in updated Red Hat Hardened Images RPM packages for qt6-qtbase.
A critical vulnerability in GitLab CE/EE versions from 19.2 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 allows unauthenticated users to execute arbitrary code on the GitLab server. This occurs due to insufficient validation of regular expressions in CI/CD configurations. The vulnerability has a CVSS score of 10.0 and public exploit code is available via Metasploit. GitLab has released fixes in versions 19.2.8, 19.3.5, and 19.4.2 to remediate this issue.
This Red Hat security advisory addresses multiple vulnerabilities in the Linux kernel packages for Red Hat Enterprise Linux 7 Extended Lifecycle Support. The fixes include removal of unsafe sprintf usage in netfilter conntrack, refreshing TCP header after ensuring writable socket buffer in synproxy, resetting vring metadata cache on vring reconfiguration in vhost, and fixing a potential use-after-free in UDP tunnel segmentation. These updates improve kernel security and stability. A system reboot is required to apply the update.
Multiple security vulnerabilities have been identified in Dovecot, an IMAP and POP3 server for UNIX-like systems. These include denial of service issues via various vectors such as crafted email headers, IMAP ID commands, ManageSieve login and arguments, connection limit exhaustion, and a use-after-free leading to arbitrary code execution. An authentication bypass vulnerability via incorrect OAuth2 token validation is also present. Red Hat has issued an important security advisory with updates addressing these issues for Red Hat Enterprise Linux 9 and related products.
Two security vulnerabilities affecting GNU Emacs have been addressed in a Red Hat Enterprise Linux 9 update. The first is a heap over-read vulnerability that can lead to information disclosure via a crafted image (CVE-2026-77219). The second is a local shell command injection vulnerability through the user field in Emacs tramp (CVE-2026-79992). Red Hat has released updated packages to fix these issues.
Multiple security vulnerabilities have been identified and fixed in the GIMP (GNU Image Manipulation Program) software, including heap and stack buffer overflows, integer overflows, and arbitrary code execution issues in various file parsing components such as PNG, PSD, TIF, SGI, and FITS plugins. These vulnerabilities could allow remote code execution or cause memory corruption when processing crafted image files. Red Hat has issued an important security update for GIMP in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions to address these issues.
CVE-2026-78669 is a vulnerability in Microsoft software version 3.0 involving excessive CPU consumption caused by repeated initial window changes in the net/http component. This issue may lead to performance degradation due to inefficient resource usage.
Red Hat has issued a security advisory for the Linux kernel packages addressing two vulnerabilities: CVE-2026-72129 and CVE-2026-74705. The first vulnerability involves the nvmet-rdma component handling inline data with a nonzero offset, and the second involves a potential use-after-free in UDP tunnel segmentation. These issues affect Red Hat Enterprise Linux 8.4 variants. A kernel update is available that fixes these vulnerabilities, and a system reboot is required for the update to take effect. Red Hat rates the security impact as Important and recommends prompt application of the update.
Multiple security vulnerabilities have been identified and fixed in FreeRDP, a free implementation of the Remote Desktop Protocol (RDP). These include denial of service and remote code execution issues caused by heap buffer overflows, out-of-bounds reads, and uninitialized memory disclosures. The vulnerabilities affect the xfreerdp client and related components. Red Hat has issued an important security update for FreeRDP in Red Hat Enterprise Linux 9 to address these issues.
A denial of service vulnerability exists in the perl-DBI package due to an invalid memory read during numeric type casting. This affects the standard database interface module for Perl. Red Hat has issued a security update for Red Hat Enterprise Linux 9 to address this issue. The vulnerability is rated as important by Red Hat Product Security.