Threat database

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions. The vulnerability relates to improper processing within the library, which could lead to memory corruption issues.

CVE-2024-12718 is a vulnerability in CPython's tarfile module that allows modification of file metadata outside the intended extraction directory via maliciously crafted tar archives using certain extraction filters. Exploitation requires convincing a privileged user or process to extract a malicious tar file, which reduces the overall impact. Red Hat's python36 package as shipped with RHEL 8 is not affected. No fix has been provided yet, and mitigation options are limited or do not meet Red Hat's criteria.

CVE-2025-46397 is a high-severity vulnerability in xfig caused by a buffer copy operation without checking the size of input in the bezier_spline function. This flaw can lead to a stack overflow, potentially allowing local code execution through manipulated input. The vulnerability affects the xfig utility used for creating FIG or PIC figures and translating them into LaTeX graphics languages. A security update addressing this issue is available from Red Hat as part of the transfig package update.

Multiple denial of service (DoS) vulnerabilities and a userinfo leakage issue have been identified in Ruby 3.1 components, including REXML, CGI, and URI modules. These vulnerabilities could allow attackers to cause service disruption or leak sensitive user information when processing specially crafted inputs. Red Hat has issued a security update for Ruby 3.1 on Red Hat Enterprise Linux 8 to address these issues.

Red Hat OpenShift Container Platform 4.17.21 includes a security update addressing a kernel vulnerability (CVE-2024-53197) related to ALSA usb-audio drivers. The flaw involves potential out-of-bound memory accesses for Extigy and Mbox devices. This update is rated as important by Red Hat Product Security. Users of OpenShift Container Platform 4.17 are advised to upgrade to the updated packages and container images when available via the appropriate release channels.

FontForge, a font editor supporting multiple font formats, has two command injection vulnerabilities (CVE-2024-25081 and CVE-2024-25082) that can be triggered via crafted filenames or archives/compressed files. These vulnerabilities were addressed in a security update released by Red Hat for Red Hat Enterprise Linux 9. The update is rated as having a moderate security impact. Users of affected Red Hat CodeReady Linux Builder products should apply the update as per Red Hat's advisory.

A moderate severity vulnerability (CVE-2024-6119) in OpenSSL affects Red Hat Enterprise Linux 9. The flaw involves a possible denial of service caused by issues in X.509 name checks. Red Hat has released security updates to address this issue.