Threat database

A security vulnerability (CVE-2025-13699) affects the mariadb-dump utility in MariaDB, allowing remote code execution due to improper path validation. This vulnerability was addressed by Red Hat in an update for Red Hat Enterprise Linux 9.2. The issue is rated with high severity by Red Hat Product Security. The advisory recommends applying the provided update to remediate the vulnerability.

Multiple security vulnerabilities have been addressed in the Python 3.9 module for Red Hat Enterprise Linux 8. These include buffer over-read issues with OpenSSL API, improper validation of IP addresses, path quoting issues in virtual environment activation scripts, extraction filter bypasses in tarfile, arbitrary writes via tarfile realpath overflow, and quadratic complexity vulnerabilities in Python's HTMLParser and os.path.expandvars functions. The update is rated as important by Red Hat Product Security and affects various Red Hat Enterprise Linux 8 variants and related builder products.

A buffer overflow vulnerability exists in libsndfile version 1.2.2 and potentially earlier versions. The vulnerability relates to improper processing within the library, which could lead to memory corruption issues.

CVE-2024-12718 is a vulnerability in CPython's tarfile module that allows modification of file metadata outside the intended extraction directory via maliciously crafted tar archives using certain extraction filters. Exploitation requires convincing a privileged user or process to extract a malicious tar file, which reduces the overall impact. Red Hat's python36 package as shipped with RHEL 8 is not affected. No fix has been provided yet, and mitigation options are limited or do not meet Red Hat's criteria.

CVE-2025-46397 is a high-severity vulnerability in xfig caused by a buffer copy operation without checking the size of input in the bezier_spline function. This flaw can lead to a stack overflow, potentially allowing local code execution through manipulated input. The vulnerability affects the xfig utility used for creating FIG or PIC figures and translating them into LaTeX graphics languages. A security update addressing this issue is available from Red Hat as part of the transfig package update.

Multiple denial of service (DoS) vulnerabilities and a userinfo leakage issue have been identified in Ruby 3.1 components, including REXML, CGI, and URI modules. These vulnerabilities could allow attackers to cause service disruption or leak sensitive user information when processing specially crafted inputs. Red Hat has issued a security update for Ruby 3.1 on Red Hat Enterprise Linux 8 to address these issues.