A use-after-free vulnerability was discovered in the pngimagefree function in the libpng library. This could lead to denial of service or a potentially exploitable crash when a malformed image is processed.
Impact When running processes using "chroot" isolation, the process being run can examine the environment variables of its immediate parent and grandparent processes (CVE-2021-3602). This isolation type is often used when running buildah in unprivileged containers, and it is often used to do so in CI/CD environments. If sensitive information is exposed to the original buildah process through its environment, that information will unintentionally be shared with child processes which it starts as part of handling RUN instructions or during buildah run. The commands that buildah is instructed to run can read that information if they choose to.
Patches Users should upgrade packages, or images which contain packages, to include version 1.21.3 or later.
Workarounds As a workaround, invoking buildah in a container under env -i to have it started with a reinitialized environment should prevent the leakage.
For more information If you have any questions or comments about this advisory: Open an issue in buildah Email us at the buildah general mailing list, or the podman security mailing list if it's sensitive.
Impact Denial of Service, Applications that allow the use of the PBKDF2 algorithm.
Patches A patch is available that sets the maximum number of default rounds.
Workarounds Applications that do not need to use PBKDF2 should simply specify the algorithms use and exclude it from the list. Applications that need to use the algorithm should upgrade to the new version that allows to set a maximum rounds number.
Acknowledgement The issues was reported by Jingcheng Yang and Jianjun Chen from Sichuan University and Zhongguancun Lab
A flaw was found in the Linux kernel. Measuring usage of the shared memory does not scale with large shared memory segment counts which could lead to resource exhaustion and DoS.
Last updated 25 August 2025
A use-after-free flaw was found in libvirt. The qemuMonitorUnregister() function in qemuProcessHandleMonitorEOF is called using multiple threads without being adequately protected by a monitor lock. This flaw could be triggered by the virConnectGetAllDomainStats API when the guest is shutting down. An unprivileged client with a read-only connection could use this flaw to perform a denial of service attack by causing the libvirt daemon to crash.