Redhat
Redhat Enterprise Linux FOR ARM 64: vulnerabilities and CVEs
Redhat Enterprise Linux FOR ARM 64 has 46 published vulnerabilities, 2 of them in the last 12 months. 3 are rated critical and 5 are listed by CISA as actively exploited.
CVEs46
Last 12 months2
Critical3
Actively exploited5
All vulnerabilities in the catalogue →⭐ Follow this technology
🔴 Actively exploited (CISA KEV)
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2023-4911 | High (7.8) | 81% | ⚠ Active exploitation | Oct 3, 2023 | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES… |
| CVE-2019-11043 | Critical (9.8) | 100% | ⚠ Active exploitation | Oct 28, 2019 | In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space reserved for FCGI… |
| CVE-2019-13272 | High (7.8) | 52% | ⚠ Active exploitation | Jul 17, 2019 | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptrace relationship, which allows local users to obtain root access by… |
| CVE-2021-40438 | Critical (9) | 100% | ⚠ Active exploitation | Sep 16, 2021 | A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier. |
| CVE-2019-0211 | High (7.8) | 65% | ⚠ Active exploitation | Apr 8, 2019 | In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (including scripts executed by an in-process scripting interpreter)… |
Latest vulnerabilities
| CVE | Severity | EPSS | Active exploitation | Published | Description |
|---|---|---|---|---|---|
| CVE-2026-1709 | Critical (9.8) | 5.5% | — | Feb 6, 2026 | A flaw was found in Keylime. The Keylime registrar, since version 7.12.0, does not enforce client-side Transport Layer Security (TLS) authentication. This authentication bypass vulnerability allows unauthenticated… |
| CVE-2025-13601 | High (7.7) | 0.32% | — | Nov 26, 2025 | A heap-based buffer overflow problem was found in glib through an incorrect calculation of buffer size in the g_escape_uri_string() function. If the string to escape contains a very large number of unacceptable… |
| CVE-2025-6021 | High (7.5) | 1.4% | — | Jun 12, 2025 | A flaw was found in libxml2's xmlBuildQName function, where integer overflows in buffer size calculations can lead to a stack-based buffer overflow. This issue can result in memory corruption or a denial of service when… |
| CVE-2025-3155 | High (7.4) | 14% | — | Apr 3, 2025 | A flaw was found in Yelp. The Gnome user help application allows the help document to execute arbitrary scripts. This vulnerability allows malicious users to input help documents, which may exfiltrate user files to an… |
| CVE-2025-2784 | Medium (6.5) | 0.84% | — | Apr 3, 2025 | A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() function. Libsoup clients may read one byte out-of-bounds in response to a… |
| CVE-2025-1756 | High (7.8) | 0.16% | — | Feb 27, 2025 | mongosh may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privilege, when a crafted file is stored in C:\node_modules\.… |
| CVE-2025-1755 | High (7.8) | 0.15% | — | Feb 27, 2025 | MongoDB Compass may be susceptible to local privilege escalation under certain conditions potentially enabling unauthorized actions on a user's system with elevated privileges, when a crafted file is stored in… |
| CVE-2024-12088 | High (7.5) | 4.7% | — | Jan 14, 2025 | A flaw was found in rsync. When using the `--safe-links` option, the rsync client fails to properly verify if a symbolic link destination sent from the server contains another symbolic link within it. This results in a… |
| CVE-2024-12087 | High (7.5) | 2.3% | — | Jan 14, 2025 | A path traversal vulnerability exists in rsync. It stems from behavior enabled by the `--inc-recursive` option, a default-enabled option for many client options and can be enabled by the server even if not explicitly… |
| CVE-2024-12085 | High (7.5) | 8.8% | — | Jan 14, 2025 | A flaw was found in rsync which could be triggered when rsync compares file checksums. This flaw allows an attacker to manipulate the checksum length (s2length) to cause a comparison between a checksum and uninitialized… |
| CVE-2024-9676 | Medium (6.5) | 1.3% | — | Oct 15, 2024 | A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill… |
| CVE-2024-9675 | Medium (4.4) | 0.39% | — | Oct 9, 2024 | A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary… |
| CVE-2024-7006 | High (7.5) | 1.5% | — | Aug 12, 2024 | A null pointer dereference flaw was found in Libtiff via `tif_dirinfo.c`. This issue may allow an attacker to trigger memory allocation failures through certain means, such as restricting the heap space size or… |
| CVE-2024-6387 | High (8.1) | 100% | — | Jul 1, 2024 | A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able… |
| CVE-2024-3049 | Medium (5.9) | 0.53% | — | Jun 6, 2024 | A flaw was found in Booth, a cluster ticket manager. If a specially-crafted hash is passed to gcry_md_get_algo_dlen(), it may allow an invalid HMAC to be accepted by the Booth server. |
| CVE-2023-3758 | High (7.1) | 1.0% | — | Apr 18, 2024 | A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users. This may lead to improper authorization issues, granting or denying access to resources inappropriately. |
| CVE-2022-24809 | Medium (6.5) | 1.1% | — | Apr 16, 2024 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-only credentials can use a malformed OID in a `GET-NEXT` to the `nsVacmAccessTable` to cause a… |
| CVE-2022-24808 | Medium (6.5) | 1.1% | — | Apr 16, 2024 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can use a malformed OID in a `SET` request to… |
| CVE-2022-24807 | Medium (6.5) | 1.0% | — | Apr 16, 2024 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a malformed OID in a SET request to `SNMP-VIEW-BASED-ACM-MIB::vacmAccessTable` can cause an out-of-bounds… |
| CVE-2022-24806 | Medium (5.3) | 1.1% | — | Apr 16, 2024 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a user with read-write credentials can exploit an Improper Input Validation vulnerability when SETing malformed… |
| CVE-2022-24805 | High (8.8) | 1.3% | — | Apr 16, 2024 | net-snmp provides various tools relating to the Simple Network Management Protocol. Prior to version 5.9.2, a buffer overflow in the handling of the `INDEX` of `NET-SNMP-VACM-MIB` can cause an out-of-bounds memory… |
| CVE-2023-7250 | Medium (5.3) | 0.93% | — | Mar 18, 2024 | A flaw was found in iperf, a utility for testing network performance using TCP, UDP, and SCTP. A malicious or malfunctioning client can send less than the expected amount of data to the iperf server, which can cause the… |
| CVE-2024-1488 | High (7.3) | 0.32% | — | Feb 15, 2024 | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port… |
| CVE-2023-6681 | Medium (5.3) | 0.88% | — | Feb 12, 2024 | A vulnerability was found in JWCrypto. This flaw allows an attacker to cause a denial of service (DoS) attack and possible password brute-force and dictionary attacks to be more resource-intensive. This issue can result… |
| CVE-2023-5992 | Medium (5.9) | 1.2% | — | Jan 31, 2024 | A vulnerability was found in OpenSC where PKCS#1 encryption padding removal is not implemented as side-channel resistant. This issue may result in the potential leak of private data. |
| CVE-2024-0193 | Medium (6.7) | 0.84% | — | Jan 2, 2024 | A use-after-free flaw was found in the netfilter subsystem of the Linux kernel. If the catchall element is garbage-collected when the pipapo set is removed, the element can be deactivated twice. This can cause a… |
| CVE-2023-4641 | Medium (5.5) | 0.26% | — | Dec 27, 2023 | A flaw was found in shadow-utils. When asking for a new password, shadow-utils asks the password twice. If the password fails on the second attempt, shadow-utils fails in cleaning the buffer used to store the first… |
| CVE-2023-5870 | Medium (4.4) | 2.6% | — | Dec 10, 2023 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the autovacuum launcher. Successful exploitation… |
| CVE-2023-5869 | High (8.8) | 4.3% | — | Dec 10, 2023 | A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during… |
| CVE-2023-5868 | Medium (4.3) | 2.8% | — | Dec 10, 2023 | A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with 'unknown'-type arguments. Handling 'unknown'-type… |
Other products by Redhat
Enterprise Linux · 1,937Enterprise Linux Desktop · 1,928Enterprise Linux Server · 1,891Enterprise Linux Workstation · 1,845Enterprise Linux Server AUS · 1,059Enterprise Linux EUS · 787Enterprise Linux Server TUS · 768Enterprise Linux Server EUS · 622Openshift Container Platform · 328Jboss Enterprise Application Platform · 244Satellite · 238Linux · 230