Threat database

A moderate severity vulnerability (CVE-2026-27456) exists in util-linux's mount program related to a Time-of-Check-Time-of-Use (TOCTOU) race condition when mounting loop devices with user and loop options in /etc/fstab. This flaw allows a local unprivileged user to gain full read access to root-owned files or block devices containing valid filesystems by exploiting a brief window where the mount program checks file paths with user permissions but opens them with root privileges. There is no memory corruption or code execution involved. The vulnerability is only exploitable if an /etc/fstab entry uses user,loop options and the source path is writable by the attacker. The Red Hat Hardened Images RPMs update advisory references this and other CVEs but does not list specific fixes for this issue. Mitigation involves removing the 'user' option from loop mounts or ensuring source paths are root-owned and not writable by unprivileged users.

An out-of-bounds read vulnerability exists in the curl project used by Red Hat products. The flaw occurs in the path comparison logic, causing curl to read outside a heap buffer boundary. This can lead to a crash or potentially allow a clear-text site to override the contents of a secure cookie, depending on adjacent memory contents. No effective mitigation is currently available that meets Red Hat's criteria for ease of use, deployment, and stability.

A server-side include (SSI) handling flaw exists in the Apache HTTP Server when SSI is enabled and mod_cgid passes the shell-escaped query string to #exec cmd="..." directives. This may allow an attacker to inject commands executed by the server. Red Hat has not provided a mitigation that meets their criteria for ease of use, deployment, or stability. No fix is currently available for affected Red Hat Hardened Images.

A stack overflow vulnerability in the xfig component of the transfig utility allows possible code execution via local input manipulation. Transfig is used to translate FIG or PIC figures into LaTeX graphics languages. This security issue has been rated as moderate severity by Red Hat and affects Red Hat CodeReady Linux Builder 9.4 Extended Update Support. An update fixing this vulnerability is available.

A security vulnerability (CVE-2025-13699) affects the mariadb-dump utility in MariaDB 10.3, allowing remote code execution due to improper path validation. This issue is addressed by a security update from Red Hat for the mariadb-devel:10.3 module in Red Hat Enterprise Linux 8. The update is rated as important by Red Hat Product Security. No CVSS score is provided in the advisory. The vulnerability is related to CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).