Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

• CVE-2026-114406 Medium 6.8 Ca-certificates: distrust emudhra intermediate ca certificates due to security concerns 0.3%
• CVE-2026-102560 High 8.6 Libsoup: libsoup: heap buffer overflow during outgoing permessage-deflate buffer growth 0.5%
• CVE-2026-102559 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket client-frame masking 0.6%
• CVE-2026-102558 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket receive-buffer growth 0.6%
• CVE-2026-102557 High 8.6 Libsoup: libsoup: heap buffer overflow during websocket message reassembly 0.5%
• CVE-2026-102556 High 8.6 Libsoup: libsoup: heap buffer overflow from websocket pong signal type confusion 0.5%
• CVE-2026-97024 High 7.1 Flatpak: flatpak: arbitrary write in root context via path traversal in deploy directory files/etc 0.5%
• CVE-2026-97023 High 7.1 Flatpak: flatpak: arbitrary file deletion in root context via path traversal in deploy directory export/bin 0.5%
• CVE-2026-96280 High 7.5 Flatpak: flatpak: buffer overflow in oci delta stream path names on 32-bit systems 0.6%
• CVE-2026-97185 High 7.8 Gimp: gimp: out-of-bounds write in gimpressionist plugin via crafted preset file 0.1%
• CVE-2026-96889 High 7.8 Librsvg: use-after-free when xml includes have duplicated entities 0.6%
• CVE-2026-96275 High 8.8 Flatpak: flatpak: arbitrary write access as root via extra-data extraction 0.6%
• CVE-2026-96512 High 7.8 Sudo: sudo: tz environment variable allows bypass of notbefore/notafter time-based authorization 0.3%
• CVE-2026-86320 High 7.8 Flatpak-builder: host code execution via `git am` hook execution in patch source extraction (`use-git-am`) 0.3%
• CVE-2026-92248 High 7.8 Gimp: integer overflow when generating a thumbnail preview for a psd file 0.2%
• CVE-2026-90947 High 7.8 Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file 0.1%
• CVE-2026-90948 High 7.8 Gimp: gimp: heap-based buffer overflow in ico loader via integer overflow in embedded png dimensions 0.2%
• CVE-2026-88924 High 7.0 Gvfs: gvfs-admin socket ownership race permits local root 0.2%
• CVE-2026-18147 High 8.1 Freeipa: ipa: freeipa/idm: cross-site scripting vulnerability allows arbitrary code execution via crafted url 0.6%
• CVE-2026-87766 High 8.8 Bubblewrap: bubblewrap: symlink traversal via /oldroot allows writing files outside sandbox during setup 0.2%
• CVE-2026-74860 High 8.5 Libxml2: double-free/uaf in libxml2 python bindings 0.7%
• CVE-2026-76561 High 7.2 Pki-core: dogtag/pki: certprofile-import allows code execution via unsanitized profile content (externalprocessconstraint) 0.8%
• CVE-2026-18922 Critical 9.8 389-ds-base: 389-ds-base: sasl plain authentication allows privilege escalation to directory manager via stale identity in cyrus sasl auxiliary property 0.6%
• CVE-2026-18453 High 7.5 389-ds-base: 389-ds-base: pre-authentication null pointer dereference via paged results and use_one_backend control in op_shared_search 0.8%
• CVE-2026-18355 High 7.5 389-ds-base: 389-ds-base: heap buffer overflow via sasl wrapped-record length lower-bound underflow in sasl_io_start_packet() 0.8%
• CVE-2026-76560 High 7.5 389-ds-base: 389-ds: anonymous ldap client can defeat selfdn aci bind-rule checks via empty bind dn 0.6%
• CVE-2026-79678 High 8.1 Freeipa: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service 0.9%
• CVE-2026-76578 Critical 9.8 Ipa: freeipa: freeipa: unauthenticated ldap client can obtain administrator credentials via the self-managed-token aci 1.3%
• CVE-2026-81665 High 7.5 Corosync: corosync: heap-based buffer overflow in totempg assembly buffer during fragmented message reassembly 0.4%
• CVE-2026-84268 High 8.8 Gvfs: sftp: heap-based buffer overflow in read_reply() 0.6%
• CVE-2026-83596 High 8.8 Webkitgtk: validate the full featurelist array once in opentypeverticaldata findfeature 0.5%
• CVE-2026-17615 High 7.5 Resteasy-core: resteasy sourceprovider remote unauthenticated file read 0.8%
• CVE-2026-78002 High 7.5 Rsyslog: rsyslog: denial of service via heap buffer overflow in rainerscript replace() function 1.1%
• CVE-2026-78376 High 8.8 Webkitgtk: use-after-free of jscvalue function parameters 0.5%
• CVE-2026-11861 Critical 9.6 Freeipa: idm: ipa: freeipa: obtaining tgs with impersonating cname through trust relationships 0.4%
• CVE-2026-73198 High 7.5 Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read 0.5%
• CVE-2026-13097 High 8.7 Ipa: privilege escalation via krbcanonicalname manipulation due to realm-unaware uniqueness enforcement in freeipa ldap datastore 0.8%
• CVE-2026-73197 High 7.5 Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read 0.6%
• CVE-2026-18917 High 7.8 Libvirt: integer overflow in nodegetfreepages rpc handler leading to heap buffer overflow 0.2%
• CVE-2026-19654 High 7.5 Rsyslog: a configuration-dependent issue in rsyslog's optional imptcp input module can allow an unauthenticated remote peer to crash rsyslogd 0.8%
• CVE-2026-73433 Medium 6.6 Gstreamer1-plugins-good: gstreamer: unsigned integer underflow in avidemux fujifilm strd parsing leading to out-of-bounds read/write 0.1%
• CVE-2026-73434 Medium 6.1 Gstreamer1-plugins-good: gstreamer: out-of-bounds read in avidemux vprp video field descriptor parsing 0.1%
• CVE-2026-19550 High 8.2 Freeipa: ipa: freeipa: trust-fetch-domains uses trust-read aci to gate a privileged ad trust refresh, allowing unauthorized ldap writes 0.5%
• CVE-2026-72694 High 7.1 Mrtg: mrtg daemon symlink-following chown allows local privilege escalation via pid file path manipulation 0.1%
• CVE-2026-63622 High 7.8 Libvirt: swtpm privilege escalation via symlink following 0.1%
• CVE-2026-59090 High 8.4 Gimp: gimp: arbitrary code execution in psd plugin due to unsigned underflow 0.6%
• CVE-2026-19389 High 7.1 Gstreamer: gstreamer1-plugins-ugly-free: gstreamer: integer overflow/underflow in asfdemux bounds checks leading to out-of-bounds read 0.4%
• CVE-2026-19387 High 7.6 Gstreamer: gstreamer1-plugins-bad-free: gstreamer: heap out-of-bounds write in adpcmdec ima/dvi adpcm decoder 0.4%
• CVE-2026-15816 High 7.5 Dracut: dracut: root code execution via unescaped error message written to sourced emergency hook script in die() 0.4%
• CVE-2026-18649 High 7.5 Gstreamer1-plugins-good: gst-plugins-good: unbounded memory growth in rtph264depay and rtph265depay rtp depayloaders 1.0%