Veille CVE

Semaine du 6 juillet au 12 juillet 2026

3 CVE

Critique 0 Élevée 2 Moyenne 0 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat OpenShift Container Platform 4 » ✕
  1. CVE-2026-15028 3.9 Faible

    Red Hat Enterprise Linux 10 · Red Hat Cost Management On-Premise 1 · Red Hat Hardened Images · Red Hat Enterprise Linux 6

    A flaw was found in libarchive. This vulnerability allows a remote attacker to trigger a heap overflow by providing a specially crafted tar archive. The issue occurs during the parsing of a PAX extended header containing a malformed SUN.holesdata sparse-file attribute. Successful exploitation could lead to a denial of service, making the system unavailable, or potentially allow for arbitrary code execution, giving the attacker control over the affected system.

  2. CVE-2026-14476 8.0 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8

    A path traversal flaw was found in SSSD's AD GPO provider. The ad_gpo_extract_smb_components() function does not sanitize .. sequences in the gPCFileSysPath LDAP attribute, allowing an attacker with AD GPO management access to write files outside the GPO cache directory as root. On default RHEL configurations with SELinux enforcing, this can be used to inject Kerberos configuration leading to authentication bypass.

  3. CVE-2026-14474 8.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8

    A flaw was found in SSSD's LDAP sudo provider. When the ldap_sudo_search_base option is not explicitly configured, SSSD searches the entire LDAP directory tree for sudoRole objects. An authenticated attacker with write access to any subtree can inject a sudoRole object granting root-level sudo privileges on all SSSD-enrolled hosts.