A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the com.redhat.RHSM1.Config.SetAll() method, a low-privileged local user could tamper with the state of the registration, by unregistering the system or by changing the current entitlements. This flaw allows an attacker to set arbitrary configuration directives for /etc/rhsm/rhsm.conf, which can be abused to cause a local privilege escalation to an unconfined root.
A low-privileged user can obtain a hash of the passwords of all domain users and perform offline brute force (kerberoasting).
It was found that all users who have TGT Kerberos tickets can request TGS for another user's principal. And since the “krbPrincipalKey” value for users is created based on their password, kerberoasting attacks on TGS tickets are possible. A potential attacker can brute force the password by requesting TGS for other users.
An out-of-bounds memory access flaw was found in the X.Org server. This issue can be triggered when a device frozen by a sync grab is reattached to a different master device. This issue may lead to an application crash, local privilege escalation (if the server runs with extended privileges), or remote code execution in SSH X11 forwarding environments.
Important: firefox security update
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.<br>New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 9.0.107 and .NET Runtime 9.0.6.Security Fix(es):<br><li> dotnet: .NET Remote Code Vulnerability (CVE-2025-30399)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation.New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 8.0.117 and .NET Runtime 8.0.17.Security Fix(es): dotnet: .NET Remote Code Vulnerability (CVE-2025-30399) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): net/http: Request smuggling due to acceptance of invalid chunked data in net/http (CVE-2025-22871) grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fix(es): grafana: Cross-site Scripting (XSS) in Grafana via Custom Frontend Plugins and Open Redirect (CVE-2025-4123) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Important: perl-FCGI security update
Important: perl-FCGI security update
Important: firefox security update
Important: thunderbird security update
Important: perl-FCGI security update
Important: perl-FCGI:0.78 security update
Important: thunderbird security update
Important: thunderbird security update
Important: thunderbird security update
Important: modsecurity security update
Important: libsoup security update
Important: webkit2gtk3 security update
Important: nodejs:20 security update
Important: nodejs:22 security update
Important: kpatch-patch-5140-2841041, kpatch-patch-5140-2841171, kpatch-patch-5140-284521, kpatch-patch-5140-284791, and kpatch-patch-5140-284921 security update
Important: kpatch-patch-5140-701121, kpatch-patch-5140-701211, kpatch-patch-5140-701241, and kpatch-patch-5140-70851 security update
Important: varnish:6 security update
Important: varnish security update
Important: varnish security update
Important: varnish security update
Important: firefox security update
Important: firefox security update