fedora vulnerabilities

Products

• Fedora 83
• Extra Packages for Enterprise Linux 20
• Fedora 37 7
• Extra Packages for Enterprise Linux 7 5
• Extra Packages for Enterprise Linux 8 4
• Fedora 36 4
• directory server 3
• dnf5daemon-server 3
• Fedora 38 3
• pacemaker configuration system 2
• dhcp 1
• dovecot22 1
• Extra Packages for Enterprise Linux (EPEL) 1
• newsx 1

Latest fedora CVEs

Newest publication first · page 1 of 4

1. CVE-2026-94422 xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.50%

   An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use t...

2. CVE-2026-19816 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

   Published 2026-09-14

   High·CVSS 7.1 EPSS 0.14%

   A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role...

3. CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

   Published 2026-09-14

   High·CVSS 7.8 EPSS 0.13%

   A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN pro...

4. CVE-2024-2746 Incomplete fix for CVE-2024-1929

   Published 2024-05-08

   High·CVSS 8.8 EPSS 0.21%

   Incomplete fix for CVE-2024-1929 The problem with CVE-2024-1929 was that the dnf5 D-Bus daemon accepted arbitrary configuration parameters from unprivileged users, which allowed a local root exploit by tricking the daemon into loading a user controlled "plugin". All of this happe...

5. CVE-2024-1929 Local Root Exploit via Configuration Dictionary

   Published 2024-05-08

   High·CVSS 8.4 EPSS 0.29%

   Local Root Exploit via Configuration Dictionary in dnf5daemon-server before 5.1.17 allows a malicious user to impact Confidentiality and Integrity via Configuration Dictionary. There are issues with the D-Bus interface long before Polkit is invoked. The org.rpm.dnf.v0.SessionMana...

6. CVE-2024-1930 No Limit on Number of Open Sessions / Bad Session Close Behaviour

   Published 2024-05-08

   Medium·CVSS 6.5 EPSS 0.30%

   No Limit on Number of Open Sessions / Bad Session Close Behaviour in dnf5daemon-server before 5.1.17 allows a malicious user to impact Availability via No Limit on Number of Open Sessions. There is no limit on how many sessions D-Bus clients may create using the open_session() D-...

7. CVE-2023-4235 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_deliver_report() function

   Published 2024-04-17

   High·CVSS 8.1 EPSS 0.94%

   A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SM...

8. CVE-2023-4234 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_submit_report() function

   Published 2024-04-17

   High·CVSS 8.1 EPSS 1.1%

   A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS...

9. CVE-2023-4233 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the sms_decode_address_field() function

   Published 2024-04-17

   High·CVSS 8.1 EPSS 1.0%

   A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS PDU decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or...

10. CVE-2023-4232 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_status_report() function

    Published 2024-04-17

    High·CVSS 8.1 EPSS 0.96%

    A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS...

11. CVE-2023-3966 Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet

    Published 2024-02-22

    High·CVSS 7.5 EPSS 1.3%

    A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.

12. CVE-2024-1312 Kernel: race condition leads to use after free during vma lock in lock_vma_under_rcu

    Published 2024-02-08

    Medium·CVSS 4.7 EPSS 0.23%

    A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system.

13. CVE-2021-4435 Yarn: untrusted search path

    Published 2024-02-04

    High·CVSS 7.8 EPSS 0.30%

    An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

14. CVE-2023-6780 Glibc: integer overflow in __vsyslog_internal()

    Published 2024-01-31

    Medium·CVSS 5.3 EPSS 2.7%

    An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size t...

15. CVE-2023-6779 Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()

    Published 2024-01-31

    High·CVSS 7.5 EPSS 3.2%

    An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incor...

16. CVE-2023-6246 Glibc: heap-based buffer overflow in __vsyslog_internal()

    Published 2024-01-31

    High·CVSS 7.8 EPSS 4.8%

    A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program...

17. CVE-2023-6258 Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths

    Published 2024-01-30

    High·CVSS 8.1 EPSS 0.57%

    A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack...

18. CVE-2023-6200 Kernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability

    Published 2024-01-28

    High·CVSS 7.5 EPSS 2.0%

    A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.

19. CVE-2023-6395 Mock: privilege escalation for users that can access mock configuration

    Published 2024-01-16

    Critical·CVSS 9.8 EPSS 1.6%

    The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja...

20. CVE-2023-7090 Sudo: improper handling of ipa_hostname leads to privilege mismanagement

    Published 2023-12-23

    High·CVSS 8.8 EPSS 0.69%

    A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.

21. CVE-2023-4255 W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223)

    Published 2023-12-21

    Medium·CVSS 5.5 EPSS 0.32%

    An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to applic...

22. CVE-2023-4256 Tcpreplay: tcprewrite: double free in tcpedit_dlt_cleanup() in plugins/dlt_plugins.c

    Published 2023-12-21

    Medium·CVSS 5.5 EPSS 0.33%

    Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local atta...

23. CVE-2023-3430 Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp

    Published 2023-12-18

    High·CVSS 7.5 EPSS 1.2%

    A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, lea...

24. CVE-2023-6560 Kernel: io_uring out of boundary memory access in __io_uaddr_map()

    Published 2023-12-08

    Medium·CVSS 5.5 EPSS 0.28%

    An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.

25. CVE-2023-5972 Kernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.c

    Published 2023-11-23

    High·CVSS 7.8 EPSS 0.28%

    A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the system or escalate their privileges on the system.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.