Search: 10.4-5

This Red Hat Security Advisory addresses multiple vulnerabilities, bug fixes, and enhancements in the Linux kernel packages for Red Hat Enterprise Linux 10.2 and related products. The update includes fixes for several security issues such as improper function calls, packet rejection errors, buffer overflows, use-after-free conditions, and lifetime management bugs across various kernel subsystems including networking, ALSA, DRM, fuse, and file systems. The advisory emphasizes the importance of applying these kernel updates and rebooting systems to ensure security and stability.

The npm package @tekmidian/pai versions 1.0.8, 1.0.9, and 1.0.10 contains malicious code. Although the codebase includes references to shell commands and base64 decoding, no direct evidence links these to active exfiltration or execution flows. However, the package is flagged as malware by a security source, indicating that any system with this package installed should be considered fully compromised. Immediate removal and secret/key rotation are recommended.

A flaw was found in the iscsiuio component of open-iscsi. The IPv6 Neighbor Discovery handler accesses link-layer address options at a fixed offset without verifying the packet contains them. Additionally, the ARP table is updated unconditionally with attacker-controlled addresses from the packet headers. An attacker on the same network segment can send a minimal Neighbor Advertisement to poison the ARP table and redirect network traffic.

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv6 option parser calls strlen() on raw network data without ensuring a NUL terminator is present, causing it to read past the buffer into heap memory. This can result in a daemon crash, a 1-byte heap overwrite, or corruption of the iSCSI initiator name. An attacker on the same network segment can trigger this by sending a crafted DHCPv6 Advertise message.

A flaw was found in the iscsiuio component of open-iscsi. The DHCPv4 option parser incorrectly calculates the length of the options data, causing it to read beyond the allocated buffer into adjacent heap memory. An attacker on the same network segment can send a crafted DHCP response to crash the daemon or corrupt its network configuration.

FreeRDP versions before 3.32.1 on Windows contain a heap out-of-bounds read vulnerability. This flaw can lead to information disclosure and a denial of service condition. The vulnerability has a CVSS 3.1 base score of 6.5, indicating a medium severity level.

A medium severity vulnerability (CVE-2026-101755) affects specific versions of the MySQL Server and MySQL Cluster product from Oracle, specifically versions 9.7.2-4 and 9.7.2-4ubuntu1. The vulnerability has an impact on availability but does not affect confidentiality or integrity. No public exploits or known active exploitation have been reported as of the publication date.

CVE-2026-101743 is a vulnerability affecting MySQL Server and MySQL Cluster products version 9.7.2-4 and 9.7.2-4ubuntu1. The flaw has a CVSS 3.1 base score of 6.5, indicating a medium severity level. The vulnerability does not impact confidentiality or integrity but results in a high impact on availability. It requires network access with low privileges and no user interaction. No known exploits are reported in the wild as of the publication date.

A vulnerability in FreeIPA allows an authenticated host to improperly retrieve and revoke digital certificates assigned to other users or services. This occurs because FreeIPA verifies certificate ownership only by matching the host name to the certificate's subject Common Name (CN) without confirming actual ownership in the directory service. As a result, an enrolled host can disrupt services by revoking certificates belonging to other entities. The issue has a medium severity with a CVSS score of 5.4.

A vulnerability in python-authlib prior to version 1.9.0 causes the default JWTBearerGrant.get_audiences() method to return an empty list. This leads to JWTBearerGrant.verify_claims() only checking for the presence of an aud claim without verifying it matches the current authorization server. Consequently, an attacker with a valid assertion for another service sharing the signing key can obtain an access token across trust boundaries. Implementations that override get_audiences() with valid audience identifiers are not affected. The issue is fixed in version 1.9.0.

Authlib, a Python library for OAuth and OpenID Connect servers, has a vulnerability in versions prior to 1.9.1 where the OctKey.import_key() and HMAC signing and verification accept zero-length keys. This allows a remote attacker to forge valid HS256, HS384, or HS512 signatures if the application returns an empty secret, enabling token forgery. The issue is fixed in version 1.9.1.

A vulnerability in the Python Authlib library versions from 1.3.1 up to but not including 1.9.0 allows an unauthenticated attacker to forge HS256 tokens. The issue arises because OctKey.import_key() only checks asymmetric-key markers at the first byte, while PEM loaders accept leading whitespace, comments, or byte-order marks. This discrepancy enables attackers who know the public key bytes to misuse them as an HMAC secret, bypassing prior remediation efforts. The vulnerability is fixed in version 1.9.0.

A flaw was found in libslirp. When handling ICMP echo requests, the reply length is not updated to match the actual data received from the host. Under specific conditions where the normal ICMP socket is unavailable, this length mismatch causes the host's real IP address to be leaked to the guest in the echo reply, breaking the NAT isolation that user-mode networking is expected to provide.

A vulnerability in Python 2.7's tarfile module allows crafted tar archives with specially crafted link entries, including symlinks with empty or directory-like names, to bypass the tar_filter protection. This can cause tarfile.extractall() with filter="tar" to write files outside the intended extraction directory, potentially leading to unauthorized file writes depending on the extracting process's permissions. This issue is related to CVE-2026-7774, which affected tarfile.data_filter.

libsmb2 versions before 6.3 contain integer overflow vulnerabilities in the DCE/RPC NDR decoder component. These flaws allow heap out-of-bounds reads and writes when processing crafted NetrShareEnum replies with wrapping actual_count or max_count values. An attacker controlling a malicious SMB server or positioned as a man-in-the-middle on unsigned SMB connections can exploit this by triggering smb2_share_enum_async() calls, leading to heap corruption.

CFITSIO versions through 4.7.0 have an out-of-bounds write vulnerability in the ffgcls2() function within getcols.c. This flaw arises from trusting attacker-controlled heap descriptor lengths for variable-length string columns, allowing crafted FITS files to overflow a fixed 28,800-byte stack buffer and the caller's string array. The vulnerability can lead to arbitrary code execution.

A type confusion vulnerability exists in Wasmtime versions before 24.0.12, 25.0.0 before 36.0.13, 37.0.0 before 46.0.2, and 47.0.0 before 47.0.3. This flaw arises because several Store APIs do not validate that objects belong to the Store's Engine. When embedders mix objects between Engines using Instance::new, StructRefPre::new, or Tag::new, it can cause trampoline signature mismatches leading to out-of-bounds stack writes, garbage collector heap corruption, or program panics. The vulnerability has a low CVSS score of 3.8 and requires high privileges and user interaction to exploit.