Threat database

A security vulnerability (CVE-2025-13699) affects the mariadb-dump utility in MariaDB, allowing remote code execution due to improper path validation. This issue is addressed in an update provided by Red Hat for Red Hat Enterprise Linux 9 and related variants. The vulnerability is rated with high severity by Red Hat Product Security. No CVSS score is provided in the data. The update fixes the flaw by backporting upstream patches to MariaDB 10.5.29 in Red Hat Enterprise Linux 9.

Multiple security vulnerabilities have been addressed in the Python 3.9 module for Red Hat Enterprise Linux 8. These include buffer over-read issues with OpenSSL API, improper validation of IP addresses, path quoting issues in virtual environment activation scripts, extraction filter bypasses in tarfile, arbitrary writes via tarfile realpath overflow, and quadratic complexity vulnerabilities in Python's HTMLParser and os.path.expandvars functions. The update is rated as important by Red Hat Product Security and affects various Red Hat Enterprise Linux 8 variants and related builder products.

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions. The vulnerability relates to improper processing within the library, which could lead to memory corruption issues.

CVE-2024-12718 is a vulnerability in CPython's tarfile module that allows modification of file metadata outside the intended extraction directory via maliciously crafted tar archives using certain extraction filters. Exploitation requires convincing a privileged user or process to extract a malicious tar file, which reduces the overall impact. Red Hat's python36 package as shipped with RHEL 8 is not affected. No fix has been provided yet, and mitigation options are limited or do not meet Red Hat's criteria.