Multiple security vulnerabilities have been identified and fixed in the libxml2 library used in Red Hat Enterprise Linux 8.8. These include denial of service via use-after-free, arbitrary code execution through various buffer overflows, data integrity issues from integer overflow, information disclosure, SSRF, and double-free/use-after-free in Python bindings. The update addresses these issues with security patches and bug fixes.
A denial of service vulnerability (CVE-2026-94286) exists in the X.Org X11 libXtst runtime library due to an out-of-bounds read in the RECORD reply parser. This issue affects Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Red Hat has issued a security advisory with an update to address this vulnerability.
Multiple heap buffer overflow vulnerabilities were discovered in libsoup, an HTTP client and server library for GNOME, related to WebSocket handling. These include issues from WebSocket Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. The vulnerabilities affect Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued an important security advisory with updates to address these flaws.
A vulnerability in ip_stack allows an out of bounds read due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation could result in a denial of service condition.
A vulnerability in the Modem component allows an out of bounds read due to an integer overflow. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on a user equipment (UE) device without requiring user interaction or additional privileges.
A logic error in the modem application can cause it to crash, potentially leading to a remote denial of service (DoS). Exploitation requires no user interaction and can occur if a user equipment (UE) connects to a rogue base station controlled by an attacker.
An integer overflow vulnerability exists in the modem component that could allow a remote denial of service (DoS) attack. Exploitation requires no user interaction and can occur if a user equipment (UE) connects to a rogue base station controlled by an attacker. No additional execution privileges are needed for the attack.
A vulnerability in the Modem component allows a possible escalation of privilege due to a permissions bypass. This issue could enable local privilege escalation if an attacker already has System-level privileges. Exploitation does not require user interaction. A patch is referenced by IDs ALPS09608864 and ALPS09327759.
A vulnerability in the modem component allows an out of bounds read due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. The exploitation could result in a denial of service condition.
CVE-2026-20591 is a vulnerability in GPU pdma involving a missing permission check that allows local escalation of privilege without requiring additional execution privileges or user interaction.
A vulnerability in the Modem component allows a possible out-of-bounds write due to a missing bounds check. This flaw could enable local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. No affected versions or patch information are provided.
A vulnerability in the modem component allows an out of bounds read due to a missing bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on the user equipment (UE) without requiring user interaction or additional privileges.
A vulnerability in the Modem component allows for possible local escalation of privilege due to a missing permission check. Exploitation does not require user interaction but requires the attacker to have already obtained System privilege.
A vulnerability in neuropilot involves a possible out of bounds write caused by a missing bounds check. This flaw could allow local escalation of privilege if an attacker already has System privilege. Exploitation does not require user interaction. No patch information is currently provided.
A vulnerability in the modem component allows an application crash due to improper input validation. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker, potentially causing a denial of service condition.
A vulnerability in the modem component allows an out of bounds read due to a missing bounds check. This flaw can be exploited remotely by an attacker controlling a rogue base station to cause a denial of service on a user equipment (UE) device without requiring user interaction or additional privileges. Patches identified as MOLY01349680 and MOLY01369097 address this issue.
A side channel information disclosure vulnerability exists in the Modem component, potentially allowing local information disclosure if an attacker has already obtained System privileges. Exploitation does not require user interaction. No CVSS score or detailed impact metrics are provided.
A memory corruption vulnerability exists in the USB component due to a missing bounds check. This flaw could allow local escalation of privilege if an attacker already has System privileges. Exploitation does not require user interaction. No patch information is currently provided.
A double free vulnerability in afe can cause memory corruption, potentially allowing local privilege escalation if the attacker already has System privileges. Exploitation does not require user interaction. No patch information is provided.
A vulnerability in the Modem component allows an out of bounds write due to an incorrect bounds check. This flaw can be exploited remotely without user interaction if a user equipment (UE) connects to a rogue base station controlled by an attacker. Exploitation could lead to a denial of service condition.