A security update for Red Hat Hardened Images addresses multiple vulnerabilities in python3.11 packages, including CVE-2026-3479, a path traversal flaw in Python's pkgutil.get_data() function. This flaw allows local attackers to access files outside intended directories due to improper validation of resource arguments. The advisory indicates medium severity for these vulnerabilities and provides updated RPM packages for remediation. No explicit patch version is stated beyond the updated package versions. No current mitigation meets Red Hat's criteria for ease of use and applicability.
Red Hat has issued a security advisory for PHP 8.2 addressing two vulnerabilities: a SQL injection vulnerability in the ext-pgsql extension due to improper backslash escaping (CVE-2026-17543) and a denial of service vulnerability caused by circular symbolic links in phar archives (CVE-2026-7260). The update rebases PHP to version 8.2.33 to fix these issues. The advisory rates the security impact as Important and affects Red Hat Enterprise Linux 8 and related variants.
Vim (Vi IMproved) is an updated and improved version of the vi editor.
Security Fix(es):
* vim: arbitrary command execution via modeline sandbox bypass (CVE-2026-34982)
* vim: zip.vim: Vim zip.vim plugin: Arbitrary file overwrite via path traversal bypass (CVE-2026-35177)
* vim: Vim: Command injection allows arbitrary code execution via malicious tag files (CVE-2026-41411)
* vim: command injection when decompressing .tgz archives (CVE-2026-46483)
* vim: Vim: Arbitrary Code Execution via crafted directory names (CVE-2026-47162)
* vim: Vim: Arbitrary code execution via Python omni-completion (CVE-2026-52858)
* vim: Vim: Arbitrary code execution via crafted step-definition patterns (CVE-2026-47167)
* vim: Vim: Denial of Service via stack out-of-bounds write in spell_soundfold_sofo() (CVE-2026-57455)
* vim: Vim: Arbitrary code execution via malicious docstrings in Python omni-completion (CVE-2026-57456)
* vim: Vim: Out-of-bounds Write in Spell File Word Count (CVE-2026-55693)
* vim: Vim: Arbitrary command execution via crafted tags file in C omni-completion (CVE-2026-59858)
* vim: Vim: Arbitrary command execution via crafted vimball (CVE-2026-73076)
* vim: Vim: Heap buffer overflow allows arbitrary code execution (CVE-2026-73072)
* vim: Vim: Arbitrary Code Execution via Crafted Netrw Menu Entries (CVE-2026-73078)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
A vulnerability in libxml2's XML catalog parsing can cause a denial of service (DoS) due to a NULL pointer dereference when a nextCatalog element lacks its mandatory catalog attribute. This flaw requires processing a specially crafted XML catalog by an application using libxml2, leading to application crashes. The issue affects Red Hat Hardened Images RPMs and has been addressed in updated libxml2 packages.
Multiple security vulnerabilities have been identified in Red Hat AI Inference Server 3.4.4 (rocm). These vulnerabilities are collectively addressed in the Red Hat AI Inference 3.4.4 release. The advisory lists several CVEs but does not provide detailed technical descriptions or specific fixes. No known exploits in the wild have been reported. The advisory does not explicitly confirm the availability of patches or fixes for these vulnerabilities.
Red Hat has issued an important security advisory for multiple vulnerabilities and bugs in the Linux kernel packages for Red Hat Enterprise Linux 8. The update addresses issues including dangling pointers, race conditions, memory counter updates, CRC overreads, double-free errors, and improper handling of allocated ranges. It also includes bug fixes and enhancements related to network interface controller stalls and resets. A system reboot is required to apply the update.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs, including updates to multiple postgresql17 packages. The advisory addresses several vulnerabilities identified by CVE-2026-14663 and others. The update provides bug fixes and enhancements to these RPMs. A patch is available and should be applied to affected versions to mitigate the vulnerabilities.
Red Hat has issued a security advisory for Red Hat Hardened Images RPMs addressing multiple vulnerabilities including CVE-2026-54876. The advisory covers updates to packages such as chunkah-0.6.0-3.hum1 for aarch64 and x86_64 architectures. The update is a bug fix and enhancement release and is available for affected systems. No detailed technical information about the vulnerabilities or exploits is provided in the advisory. Users are advised to apply the update as per Red Hat's guidance.
A vulnerability in Python 3.10's csv.Sniffer.sniff() function can cause excessive CPU consumption due to super-linear regular expression complexity when processing specially crafted CSV input. This may lead to a denial of service (DoS) condition. The issue affects Red Hat Hardened Images RPMs containing Python 3.10 packages. Most applications are not affected as they do not use the sniff() function on untrusted input. Red Hat has released updated RPMs to address this issue.
An authenticated Server-Side Request Forgery (SSRF) vulnerability exists in the OpenShift Console Dev Console webhook helpers in Red Hat OpenShift Container Platform 4.18.53. This flaw allows user-supplied URLs to be fetched server-side without proper validation, enabling arbitrary endpoint targeting and full response reflection from the console pod's privileged network position. The vulnerability has a high severity rating and affects on-premise or private cloud deployments of OpenShift Container Platform 4.18.53. Mitigation involves applying NetworkPolicy egress restrictions to limit outbound connectivity from the console pod to only required endpoints. Users are advised to upgrade to the updated packages and images provided in this advisory.
A denial of service vulnerability exists in the aardvark-dns RPM package used in Red Hat Enterprise Linux 9 and 10. The flaw is triggered by truncated TCP DNS queries and connection resets. Red Hat Product Security rates this issue as moderate severity and has released a patch to address it.
This advisory covers a security update for Red Hat Hardened Images RPMs, specifically addressing vulnerabilities in java-21-openjdk packages. The update includes multiple RPMs for different architectures and debug variants. The vulnerabilities are identified by CVE-2026-60589 and involve issues categorized under CWE-918, CWE-212, and CWE-770. A patch is available to fix these issues. The advisory references an Oracle Critical Security Patch Update that includes a broad set of security fixes across many Oracle products. No known exploits are reported in the wild for this vulnerability. The severity is assessed as medium based on the information provided.
A low-impact security flaw exists in the popt library used in Red Hat Hardened Images. The flaw is an off-by-one error in the poptStuffArgs function that can corrupt internal program data when called repeatedly or through deep alias nesting. Exploitation requires a host application to unsafely handle the corrupted data, potentially allowing local code execution. Red Hat has released updated popt RPM packages to address this vulnerability.
The kernel packages contain the Linux kernel, the core of any Linux operating system.
Security Fix(es):
* kernel: scsi: core: Wake up the error handler when final completions race against each other (CVE-2026-23110)
* kernel: net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CVE-2026-31411)
* kernel: crypto: ccp - copy IV using skcipher ivsize (CVE-2026-53016)
* kernel: dm log: fix out-of-bounds write due to region_count overflow (CVE-2026-53059)
Bug Fix(es) and Enhancement(s):
* Kernels 5.14.0-434+ may lose page table dirty bit (and page data) [rhel-9.6.z] (JIRA:RHEL-220786)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Multiple security vulnerabilities affecting Vim version 9.2.0957 in Red Hat Hardened Images have been fixed in this update. These vulnerabilities include stack buffer overflow, use-after-free, heap buffer overflows, out-of-bounds access, and arbitrary code execution issues. The flaws could lead to denial of service, process crashes, or potential arbitrary code execution. The update upgrades Vim to version 9.2.967-1.hum1 to address these issues. Additional non-security bug fixes and improvements are also included.