Fedora vulnerabilities

Latest Fedora CVEs

Newest publication first · page 1 of 4

1. CVE-2026-94422 xdg-dbus-proxy: message filtering bypass via reply serial allows sandbox escape

   Published 2026-10-02

   High·CVSS 8.7 EPSS 0.50%

   An incorrect implementation of message filtering in xdg-dbus-proxy versions before 0.1.9 allows an attacker to bypass the intended message filtering on the D-Bus session bus by setting a reply serial number on non-reply messages. A malicious or compromised Flatpak app could use t...

2. CVE-2026-19816 PackageKit: dnf5 backend ignores SIMULATE on RepoRemove

   Published 2026-09-14

   High·CVSS 7.1 EPSS 0.14%

   A flaw was found in PackageKit. PackageKit skips the polkit authorization check for transactions carrying the SIMULATE (dry-run) flag. In the dnf5 backend, the RepoRemove handler ignores that contract and always executes the real transaction because its guard is written as (role...

3. CVE-2026-19624 NetworkManager-l2tp: local privilege escalation via ipsec.conf injection

   Published 2026-09-14

   High·CVSS 7.8 EPSS 0.13%

   A flaw was found in NetworkManager-l2tp. The plugin writes attacker-controlled VPN connection properties (vpn.data and vpn.secrets values) unescaped into a generated ipsec.conf file that pluto loads as root. A local unprivileged user can create and activate their own L2TP VPN pro...

4. CVE-2023-4235 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_deliver_report() function

   Published 2024-04-17

   High·CVSS 8.1 EPSS 0.94%

   A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_deliver_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SM...

5. CVE-2023-4234 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_submit_report() function

   Published 2024-04-17

   High·CVSS 8.1 EPSS 1.1%

   A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_submit_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS...

6. CVE-2023-4233 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the sms_decode_address_field() function

   Published 2024-04-17

   High·CVSS 8.1 EPSS 1.0%

   A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the sms_decode_address_field() function during the SMS PDU decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or...

7. CVE-2023-4232 Ofono: sms decoder stack-based buffer overflow remote code execution vulnerability within the decode_status_report() function

   Published 2024-04-17

   High·CVSS 8.1 EPSS 0.96%

   A flaw was found in ofono, an Open Source Telephony on Linux. A stack overflow bug is triggered within the decode_status_report() function during the SMS decoding. It is assumed that the attack scenario is accessible from a compromised modem, a malicious base station, or just SMS...

8. CVE-2023-3966 Openvswsitch: ovs-vswitch fails to recover after malformed geneve metadata packet

   Published 2024-02-22

   High·CVSS 7.5 EPSS 1.3%

   A flaw was found in Open vSwitch where multiple versions are vulnerable to crafted Geneve packets, which may result in a denial of service and invalid memory accesses. Triggering this issue requires that hardware offloading via the netlink path is enabled.

9. CVE-2024-1312 Kernel: race condition leads to use after free during vma lock in lock_vma_under_rcu

   Published 2024-02-08

   Medium·CVSS 4.7 EPSS 0.23%

   A use-after-free flaw was found in the Linux kernel's Memory Management subsystem when a user wins two races at the same time with a fail in the mas_prev_slot function. This issue could allow a local user to crash the system.

10. CVE-2021-4435 Yarn: untrusted search path

    Published 2024-02-04

    High·CVSS 7.8 EPSS 0.30%

    An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.

11. CVE-2023-6780 Glibc: integer overflow in __vsyslog_internal()

    Published 2024-01-31

    Medium·CVSS 5.3 EPSS 2.7%

    An integer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a very long message, leading to an incorrect calculation of the buffer size t...

12. CVE-2023-6779 Glibc: off-by-one heap-based buffer overflow in __vsyslog_internal()

    Published 2024-01-31

    High·CVSS 7.5 EPSS 3.2%

    An off-by-one heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when these functions are called with a message bigger than INT_MAX bytes, leading to an incor...

13. CVE-2023-6246 Glibc: heap-based buffer overflow in __vsyslog_internal()

    Published 2024-01-31

    High·CVSS 7.8 EPSS 4.8%

    A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vsyslog functions. This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program...

14. CVE-2023-6258 Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths

    Published 2024-01-30

    High·CVSS 8.1 EPSS 0.57%

    A security vulnerability has been identified in the pkcs11-provider, which is associated with Public-Key Cryptography Standards (PKCS#11). If exploited successfully, this vulnerability could result in a Bleichenbacher-like security flaw, potentially enabling a side-channel attack...

15. CVE-2023-6200 Kernel: icmpv6 router advertisement packets, aka linux tcp/ip remote code execution vulnerability

    Published 2024-01-28

    High·CVSS 7.5 EPSS 2.0%

    A race condition was found in the Linux Kernel. Under certain conditions, an unauthenticated attacker from an adjacent network could send an ICMPv6 router advertisement packet, causing arbitrary code execution.

16. CVE-2023-6395 Mock: privilege escalation for users that can access mock configuration

    Published 2024-01-16

    Critical·CVSS 9.8 EPSS 1.6%

    The Mock software contains a vulnerability wherein an attacker could potentially exploit privilege escalation, enabling the execution of arbitrary code with root user privileges. This weakness stems from the absence of proper sandboxing during the expansion and execution of Jinja...

17. CVE-2023-7090 Sudo: improper handling of ipa_hostname leads to privilege mismanagement

    Published 2023-12-23

    High·CVSS 8.8 EPSS 0.69%

    A flaw was found in sudo in the handling of ipa_hostname, where ipa_hostname from /etc/sssd/sssd.conf was not propagated in sudo. Therefore, it leads to privilege mismanagement vulnerability in applications, where client hosts retain privileges even after retracting them.

18. CVE-2023-4255 W3m: out-of-bounds write in function checktype() in etc.c (incomplete fix for cve-2022-38223)

    Published 2023-12-21

    Medium·CVSS 5.5 EPSS 0.32%

    An out-of-bounds write issue has been discovered in the backspace handling of the checkType() function in etc.c within the W3M application. This vulnerability is triggered by supplying a specially crafted HTML file to the w3m binary. Exploitation of this flaw could lead to applic...

19. CVE-2023-4256 Tcpreplay: tcprewrite: double free in tcpedit_dlt_cleanup() in plugins/dlt_plugins.c

    Published 2023-12-21

    Medium·CVSS 5.5 EPSS 0.33%

    Within tcpreplay's tcprewrite, a double free vulnerability has been identified in the tcpedit_dlt_cleanup() function within plugins/dlt_plugins.c. This vulnerability can be exploited by supplying a specifically crafted file to the tcprewrite binary. This flaw enables a local atta...

20. CVE-2023-3430 Openimageio: heap-buffer-overflow in file src/gif.imageio/gifinput.cpp

    Published 2023-12-18

    High·CVSS 7.5 EPSS 1.2%

    A vulnerability was found in OpenImageIO, where a heap buffer overflow exists in the src/gif.imageio/gifinput.cpp file. This flaw allows a remote attacker to pass a specially crafted file to the application, which triggers a heap-based buffer overflow and could cause a crash, lea...

21. CVE-2023-6560 Kernel: io_uring out of boundary memory access in __io_uaddr_map()

    Published 2023-12-08

    Medium·CVSS 5.5 EPSS 0.28%

    An out-of-bounds memory access flaw was found in the io_uring SQ/CQ rings functionality in the Linux kernel. This issue could allow a local user to crash the system.

22. CVE-2023-5972 Kernel: the nfta_inner_num and nfta_expr_name netlink attributes accessed without checking its presence in nft_inner.c

    Published 2023-11-23

    High·CVSS 7.8 EPSS 0.28%

    A null pointer dereference flaw was found in the nft_inner.c functionality of netfilter in the Linux kernel. This issue could allow a local user to crash the system or escalate their privileges on the system.

23. CVE-2023-6238 Kernel: nvme: memory corruption via unprivileged user passthrough

    Published 2023-11-21

    Medium·CVSS 6.7 EPSS 0.29%

    A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small meta buffer and let the device perform larger Direct Memory Access (DMA) into the same buffer, overwriting unrelated kernel memory, causing r...

24. CVE-2023-6039 Kernel: use-after-free in drivers/net/usb/lan78xx.c in lan78xx_disconnect

    Published 2023-11-09

    Medium·CVSS 5.5 EPSS 0.27%

    A use-after-free flaw was found in lan78xx_disconnect in drivers/net/usb/lan78xx.c in the network sub-component, net/usb/lan78xx in the Linux Kernel. This flaw allows a local attacker to crash the system when the LAN78XX USB device detaches.

25. CVE-2023-4154 Samba: ad dc password exposure to privileged users and rodcs

    Published 2023-11-07

    Medium·CVSS 6.5 EPSS 1.4%

    A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active Directory to privileged users and Read-Only Domain Controllers (RODCs). This flaw allows RODCs and users possessing the GET_CHANGES right to access all attributes, inc...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.