Veille CVE

Semaine du 17 août au 23 août 2026

12 CVE

Critique 0 Élevée 7 Moyenne 5 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Red Hat Enterprise Linux 7 » ✕
  1. CVE-2026-73199 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service.

  2. CVE-2026-73198 7.5 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.

  3. CVE-2026-73197 7.5 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

  4. CVE-2026-73196 6.5 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.

  5. CVE-2026-13097 8.7 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    A privilege escalation flaw was found in FreeIPA. The uniqueness constraint enforced on Kerberos principal name attributes in the 389-ds directory server does not properly account for equivalent representations of the same principal name, allowing a user with sufficient LDAP write privileges to create a service principal that impersonates an existing privileged one. This can lead to unauthorized acquisition of Kerberos service tickets for sensitive services, potentially resulting in full domain compromise.

  6. CVE-2026-11861 8.1 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 8.8 Telecommunications Update Service

    A flaw was found in FreeIPA. When a trust relationship is configured between FreeIPA and Active Directory, Active Directory users can bypass authentication for FreeIPA services, including the portal, SMB server, and LDAP directory. This is possible by impersonating a client name in the Ticket Granting Service (TGS) due to FreeIPA services not verifying Privilege Attribute Certificate (PAC) certificates. This vulnerability could allow an authenticated Active Directory user to escalate their privileges within the FreeIPA domain.

  7. CVE-2026-18917 7.8 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 10.0 Extended Update Support · Red Hat Enterprise Linux 7 Extended Lifecycle Support · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support

    A flaw was found in libvirt. An unprivileged local user could exploit an integer overflow vulnerability in the NodeGetFreePages RPC handler. This flaw allows crafted values to bypass a size check, leading to an undersized memory buffer. Subsequently, real NUMA node data can overwrite this buffer. This heap buffer overflow can corrupt the root libvirt daemon's memory, potentially leading to a denial of service or local privilege escalation.

  8. CVE-2026-77014 5.3 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in libsoup's SoupServer HTTP Range header processing. The sort_ranges() comparator in soup-message-headers.c truncates a 64-bit subtraction result to 32-bit int, flipping the sign for range offsets differing by more than INT_MAX. This causes silent omission of requested byte ranges from HTTP 206 Partial Content responses on resources larger than approximately 2 GB.

  9. CVE-2026-43961 7.8 Élevée

    vim · Red Hat Hardened Images · Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6

    A flaw was found in Vim's netrw plugin. A crafted filename containing quote characters and expression fragments can break out of the quoted context during mark/unmark operations, allowing arbitrary Vimscript execution. This can be leveraged to run shell commands with the privileges of the user running Vim.

  10. CVE-2026-76235 7.5 Élevée

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    A memory leak flaw was found in cockpit-ws. The login page handler leaks a heap allocation on every unauthenticated request that carries a CockpitLang cookie, allowing a remote unauthenticated attacker to exhaust memory on the host and cause a denial of service.

  11. CVE-2026-75900 6.1 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 8 · Red Hat Enterprise Linux 9

    An out-of-bounds read vulnerability was found in swtpm's SWTPM_NVRAM_CheckHeader() function. The entry guard checks the buffer length against sizeof(bh), where bh is a pointer, instead of sizeof(*bh), the actual struct size. This allows an undersized buffer to pass validation, causing a 2-byte heap overread on 64-bit systems (6 bytes on 32-bit) when accessing the totlen field. This may cause daemon termination on some platforms and leaks heap data to the log.

  12. CVE-2026-75032 6.3 Moyenne

    Red Hat Enterprise Linux 10 · Red Hat Enterprise Linux 6 · Red Hat Enterprise Linux 7 · Red Hat Enterprise Linux 8

    A flaw was found in BlueZ. Insufficient validation of packet length fields in GetFolderItems responses within the Audio/Video Remote Control Profile (AVRCP) implementation allows a malicious Bluetooth device within range to cause an out-of-bounds memory read. This vulnerability, affecting the parse_media_element() and parse_media_folder() functions, can lead to a crash of the bluetoothd daemon, resulting in a Denial of Service (DoS). It could also potentially expose sensitive heap memory contents. Exploitation requires user interaction to pair with the malicious device.