Red Hat Enterprise Linux 8 update for GNOME

1) Incorrect default permissions

EUVDB-ID: #VU18944

Risk: Low

CVSSv3.1: 3.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2019-13012

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions for files and folders that are set by the application. A local user with access to the system can view contents of files and directories or modify them.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

gnome-settings-daemon (Red Hat package): 3.32.0-4.el8 - 3.32.0-9.el8_2.1

gnome-control-center (Red Hat package): 3.28.2-5.el8 - 3.28.2-22.el8

webkit2gtk3 (Red Hat package): 2.24.3-1.el8 - 2.24.4-2.el8_1

vala (Red Hat package): 0.40.19-1.el8

nautilus (Red Hat package): 3.28.1-10.el8 - 3.28.1-12.el8

mutter (Red Hat package): 3.32.2-10.el8 - 3.32.2-34.el8

gnome-terminal (Red Hat package): 3.28.3-1.el8

gnome-software (Red Hat package): 3.30.6-2.el8 - 3.30.6-3.el8

gnome-shell (Red Hat package): 3.32.2-9.el8 - 3.32.2-14.el8

gnome-online-accounts (Red Hat package): 3.28.2-1.el8

gnome-boxes (Red Hat package): 3.28.5-7.el8 - 3.28.5-8.el8

gjs (Red Hat package): 1.56.2-3.el8 - 1.56.2-4.el8

gdm (Red Hat package): 3.28.3-22.el8 - 3.28.3-29.el8

accountsservice (Red Hat package): 0.6.50-7.el8 - 0.6.50-8.el8

glib2 (Red Hat package): 2.56.4-7.el8 - 2.56.4-8.el8

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

gvfs (Red Hat package): 1.36.2-6.el8

gnome-shell-extensions (Red Hat package): 3.32.1-10.el8

chrome-gnome-shell (Red Hat package): 10.1-6.el8

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

libsass (Red Hat package): before 3.4.5-6.el8

gtk-doc (Red Hat package): before 1.28-3.el8

woff2 (Red Hat package): before 1.0.2-5.el8

soundtouch (Red Hat package): before 2.0.0-3.el8

pangomm (Red Hat package): before 2.40.1-6.el8

libvisual (Red Hat package): before 0.4.0-25.el8

20 (Red Hat package): before 2.10.0-6.el8

libepubgen (Red Hat package): before 0.1.0-3.el8

libdazzle (Red Hat package): before 3.28.5-2.el8

gtkmm30 (Red Hat package): before 3.22.2-3.el8

gtkmm24 (Red Hat package): before 2.24.5-6.el8

gtk2 (Red Hat package): before 2.24.32-5.el8

gnome-photos (Red Hat package): before 3.28.1-4.el8

glibmm24 (Red Hat package): before 2.56.0-2.el8

geocode-glib (Red Hat package): before 3.26.0-3.el8

geoclue2 (Red Hat package): before 2.5.5-2.el8

gamin (Red Hat package): before 0.1.10-32.el8

enchant2 (Red Hat package): before 2.2.3-3.el8

dleyna-server (Red Hat package): before 0.6.0-3.el8

dleyna-core (Red Hat package): before 0.6.0-3.el8

cairomm (Red Hat package): before 1.12.0-8.el8

atkmm (Red Hat package): before 2.24.2-7.el8

OpenEXR (Red Hat package): before 2.2.0-12.el8

External links

http://access.redhat.com/errata/RHSA-2021:1586

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Type Confusion

EUVDB-ID: #VU46801

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9948

CWE-ID: CWE-843 - Type confusion

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a type confusion error in WebKit component in Apple Safari. A remote attacker can trick the victim to visit a specially crafted web page, trigger a type confusion error and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

gnome-settings-daemon (Red Hat package): 3.32.0-4.el8 - 3.32.0-9.el8_2.1

gnome-control-center (Red Hat package): 3.28.2-5.el8 - 3.28.2-22.el8

webkit2gtk3 (Red Hat package): 2.24.3-1.el8 - 2.24.4-2.el8_1

vala (Red Hat package): 0.40.19-1.el8

nautilus (Red Hat package): 3.28.1-10.el8 - 3.28.1-12.el8

mutter (Red Hat package): 3.32.2-10.el8 - 3.32.2-34.el8

gnome-terminal (Red Hat package): 3.28.3-1.el8

gnome-software (Red Hat package): 3.30.6-2.el8 - 3.30.6-3.el8

gnome-shell (Red Hat package): 3.32.2-9.el8 - 3.32.2-14.el8

gnome-online-accounts (Red Hat package): 3.28.2-1.el8

gnome-boxes (Red Hat package): 3.28.5-7.el8 - 3.28.5-8.el8

gjs (Red Hat package): 1.56.2-3.el8 - 1.56.2-4.el8

gdm (Red Hat package): 3.28.3-22.el8 - 3.28.3-29.el8

accountsservice (Red Hat package): 0.6.50-7.el8 - 0.6.50-8.el8

glib2 (Red Hat package): 2.56.4-7.el8 - 2.56.4-8.el8

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

gvfs (Red Hat package): 1.36.2-6.el8

gnome-shell-extensions (Red Hat package): 3.32.1-10.el8

chrome-gnome-shell (Red Hat package): 10.1-6.el8

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

libsass (Red Hat package): before 3.4.5-6.el8

gtk-doc (Red Hat package): before 1.28-3.el8

woff2 (Red Hat package): before 1.0.2-5.el8

soundtouch (Red Hat package): before 2.0.0-3.el8

pangomm (Red Hat package): before 2.40.1-6.el8

libvisual (Red Hat package): before 0.4.0-25.el8

20 (Red Hat package): before 2.10.0-6.el8

libepubgen (Red Hat package): before 0.1.0-3.el8

libdazzle (Red Hat package): before 3.28.5-2.el8

gtkmm30 (Red Hat package): before 3.22.2-3.el8

gtkmm24 (Red Hat package): before 2.24.5-6.el8

gtk2 (Red Hat package): before 2.24.32-5.el8

gnome-photos (Red Hat package): before 3.28.1-4.el8

glibmm24 (Red Hat package): before 2.56.0-2.el8

geocode-glib (Red Hat package): before 3.26.0-3.el8

geoclue2 (Red Hat package): before 2.5.5-2.el8

gamin (Red Hat package): before 0.1.10-32.el8

enchant2 (Red Hat package): before 2.2.3-3.el8

dleyna-server (Red Hat package): before 0.6.0-3.el8

dleyna-core (Red Hat package): before 0.6.0-3.el8

cairomm (Red Hat package): before 1.12.0-8.el8

atkmm (Red Hat package): before 2.24.2-7.el8

OpenEXR (Red Hat package): before 2.2.0-12.el8

External links

http://access.redhat.com/errata/RHSA-2021:1586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Use-after-free

EUVDB-ID: #VU46802

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9951

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error within the aboutBlankURL() function in WebKit component in Apple Safari. A remote attacker can create a specially crafted web page, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

gnome-settings-daemon (Red Hat package): 3.32.0-4.el8 - 3.32.0-9.el8_2.1

gnome-control-center (Red Hat package): 3.28.2-5.el8 - 3.28.2-22.el8

webkit2gtk3 (Red Hat package): 2.24.3-1.el8 - 2.24.4-2.el8_1

vala (Red Hat package): 0.40.19-1.el8

nautilus (Red Hat package): 3.28.1-10.el8 - 3.28.1-12.el8

mutter (Red Hat package): 3.32.2-10.el8 - 3.32.2-34.el8

gnome-terminal (Red Hat package): 3.28.3-1.el8

gnome-software (Red Hat package): 3.30.6-2.el8 - 3.30.6-3.el8

gnome-shell (Red Hat package): 3.32.2-9.el8 - 3.32.2-14.el8

gnome-online-accounts (Red Hat package): 3.28.2-1.el8

gnome-boxes (Red Hat package): 3.28.5-7.el8 - 3.28.5-8.el8

gjs (Red Hat package): 1.56.2-3.el8 - 1.56.2-4.el8

gdm (Red Hat package): 3.28.3-22.el8 - 3.28.3-29.el8

accountsservice (Red Hat package): 0.6.50-7.el8 - 0.6.50-8.el8

glib2 (Red Hat package): 2.56.4-7.el8 - 2.56.4-8.el8

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

gvfs (Red Hat package): 1.36.2-6.el8

gnome-shell-extensions (Red Hat package): 3.32.1-10.el8

chrome-gnome-shell (Red Hat package): 10.1-6.el8

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

libsass (Red Hat package): before 3.4.5-6.el8

gtk-doc (Red Hat package): before 1.28-3.el8

woff2 (Red Hat package): before 1.0.2-5.el8

soundtouch (Red Hat package): before 2.0.0-3.el8

pangomm (Red Hat package): before 2.40.1-6.el8

libvisual (Red Hat package): before 0.4.0-25.el8

20 (Red Hat package): before 2.10.0-6.el8

libepubgen (Red Hat package): before 0.1.0-3.el8

libdazzle (Red Hat package): before 3.28.5-2.el8

gtkmm30 (Red Hat package): before 3.22.2-3.el8

gtkmm24 (Red Hat package): before 2.24.5-6.el8

gtk2 (Red Hat package): before 2.24.32-5.el8

gnome-photos (Red Hat package): before 3.28.1-4.el8

glibmm24 (Red Hat package): before 2.56.0-2.el8

geocode-glib (Red Hat package): before 3.26.0-3.el8

geoclue2 (Red Hat package): before 2.5.5-2.el8

gamin (Red Hat package): before 0.1.10-32.el8

enchant2 (Red Hat package): before 2.2.3-3.el8

dleyna-server (Red Hat package): before 0.6.0-3.el8

dleyna-core (Red Hat package): before 0.6.0-3.el8

cairomm (Red Hat package): before 1.12.0-8.el8

atkmm (Red Hat package): before 2.24.2-7.el8

OpenEXR (Red Hat package): before 2.2.0-12.el8

External links

http://access.redhat.com/errata/RHSA-2021:1586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Out-of-bounds write

EUVDB-ID: #VU46804

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-9983

CWE-ID: CWE-787 - Out-of-bounds write

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error when processing untrusted input in WebKit component in Apple Safari. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger out-of-bounds write and execute arbitrary code on the target system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

gnome-settings-daemon (Red Hat package): 3.32.0-4.el8 - 3.32.0-9.el8_2.1

gnome-control-center (Red Hat package): 3.28.2-5.el8 - 3.28.2-22.el8

webkit2gtk3 (Red Hat package): 2.24.3-1.el8 - 2.24.4-2.el8_1

vala (Red Hat package): 0.40.19-1.el8

nautilus (Red Hat package): 3.28.1-10.el8 - 3.28.1-12.el8

mutter (Red Hat package): 3.32.2-10.el8 - 3.32.2-34.el8

gnome-terminal (Red Hat package): 3.28.3-1.el8

gnome-software (Red Hat package): 3.30.6-2.el8 - 3.30.6-3.el8

gnome-shell (Red Hat package): 3.32.2-9.el8 - 3.32.2-14.el8

gnome-online-accounts (Red Hat package): 3.28.2-1.el8

gnome-boxes (Red Hat package): 3.28.5-7.el8 - 3.28.5-8.el8

gjs (Red Hat package): 1.56.2-3.el8 - 1.56.2-4.el8

gdm (Red Hat package): 3.28.3-22.el8 - 3.28.3-29.el8

accountsservice (Red Hat package): 0.6.50-7.el8 - 0.6.50-8.el8

glib2 (Red Hat package): 2.56.4-7.el8 - 2.56.4-8.el8

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

gvfs (Red Hat package): 1.36.2-6.el8

gnome-shell-extensions (Red Hat package): 3.32.1-10.el8

chrome-gnome-shell (Red Hat package): 10.1-6.el8

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

libsass (Red Hat package): before 3.4.5-6.el8

gtk-doc (Red Hat package): before 1.28-3.el8

woff2 (Red Hat package): before 1.0.2-5.el8

soundtouch (Red Hat package): before 2.0.0-3.el8

pangomm (Red Hat package): before 2.40.1-6.el8

libvisual (Red Hat package): before 0.4.0-25.el8

20 (Red Hat package): before 2.10.0-6.el8

libepubgen (Red Hat package): before 0.1.0-3.el8

libdazzle (Red Hat package): before 3.28.5-2.el8

gtkmm30 (Red Hat package): before 3.22.2-3.el8

gtkmm24 (Red Hat package): before 2.24.5-6.el8

gtk2 (Red Hat package): before 2.24.32-5.el8

gnome-photos (Red Hat package): before 3.28.1-4.el8

glibmm24 (Red Hat package): before 2.56.0-2.el8

geocode-glib (Red Hat package): before 3.26.0-3.el8

geoclue2 (Red Hat package): before 2.5.5-2.el8

gamin (Red Hat package): before 0.1.10-32.el8

enchant2 (Red Hat package): before 2.2.3-3.el8

dleyna-server (Red Hat package): before 0.6.0-3.el8

dleyna-core (Red Hat package): before 0.6.0-3.el8

cairomm (Red Hat package): before 1.12.0-8.el8

atkmm (Red Hat package): before 2.24.2-7.el8

OpenEXR (Red Hat package): before 2.2.0-12.el8

External links

http://access.redhat.com/errata/RHSA-2021:1586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Use-after-free

EUVDB-ID: #VU48720

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-13543

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger a use-after-free error  and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

gnome-settings-daemon (Red Hat package): 3.32.0-4.el8 - 3.32.0-9.el8_2.1

gnome-control-center (Red Hat package): 3.28.2-5.el8 - 3.28.2-22.el8

webkit2gtk3 (Red Hat package): 2.24.3-1.el8 - 2.24.4-2.el8_1

vala (Red Hat package): 0.40.19-1.el8

nautilus (Red Hat package): 3.28.1-10.el8 - 3.28.1-12.el8

mutter (Red Hat package): 3.32.2-10.el8 - 3.32.2-34.el8

gnome-terminal (Red Hat package): 3.28.3-1.el8

gnome-software (Red Hat package): 3.30.6-2.el8 - 3.30.6-3.el8

gnome-shell (Red Hat package): 3.32.2-9.el8 - 3.32.2-14.el8

gnome-online-accounts (Red Hat package): 3.28.2-1.el8

gnome-boxes (Red Hat package): 3.28.5-7.el8 - 3.28.5-8.el8

gjs (Red Hat package): 1.56.2-3.el8 - 1.56.2-4.el8

gdm (Red Hat package): 3.28.3-22.el8 - 3.28.3-29.el8

accountsservice (Red Hat package): 0.6.50-7.el8 - 0.6.50-8.el8

glib2 (Red Hat package): 2.56.4-7.el8 - 2.56.4-8.el8

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

gvfs (Red Hat package): 1.36.2-6.el8

gnome-shell-extensions (Red Hat package): 3.32.1-10.el8

chrome-gnome-shell (Red Hat package): 10.1-6.el8

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

libsass (Red Hat package): before 3.4.5-6.el8

gtk-doc (Red Hat package): before 1.28-3.el8

woff2 (Red Hat package): before 1.0.2-5.el8

soundtouch (Red Hat package): before 2.0.0-3.el8

pangomm (Red Hat package): before 2.40.1-6.el8

libvisual (Red Hat package): before 0.4.0-25.el8

20 (Red Hat package): before 2.10.0-6.el8

libepubgen (Red Hat package): before 0.1.0-3.el8

libdazzle (Red Hat package): before 3.28.5-2.el8

gtkmm30 (Red Hat package): before 3.22.2-3.el8

gtkmm24 (Red Hat package): before 2.24.5-6.el8

gtk2 (Red Hat package): before 2.24.32-5.el8

gnome-photos (Red Hat package): before 3.28.1-4.el8

glibmm24 (Red Hat package): before 2.56.0-2.el8

geocode-glib (Red Hat package): before 3.26.0-3.el8

geoclue2 (Red Hat package): before 2.5.5-2.el8

gamin (Red Hat package): before 0.1.10-32.el8

enchant2 (Red Hat package): before 2.2.3-3.el8

dleyna-server (Red Hat package): before 0.6.0-3.el8

dleyna-core (Red Hat package): before 0.6.0-3.el8

cairomm (Red Hat package): before 1.12.0-8.el8

atkmm (Red Hat package): before 2.24.2-7.el8

OpenEXR (Red Hat package): before 2.2.0-12.el8

External links

http://access.redhat.com/errata/RHSA-2021:1586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Use-after-free

EUVDB-ID: #VU48617

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2020-13584

CWE-ID: CWE-416 - Use After Free

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a use-after-free error when processing HTML content. A remote attacker can trick the victim to visit a specially crafted website, trigger a use-after-free error and execute arbitrary code on the system.

Successful exploitation of the vulnerability may allow an attacker to compromise vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

gnome-settings-daemon (Red Hat package): 3.32.0-4.el8 - 3.32.0-9.el8_2.1

gnome-control-center (Red Hat package): 3.28.2-5.el8 - 3.28.2-22.el8

webkit2gtk3 (Red Hat package): 2.24.3-1.el8 - 2.24.4-2.el8_1

vala (Red Hat package): 0.40.19-1.el8

nautilus (Red Hat package): 3.28.1-10.el8 - 3.28.1-12.el8

mutter (Red Hat package): 3.32.2-10.el8 - 3.32.2-34.el8

gnome-terminal (Red Hat package): 3.28.3-1.el8

gnome-software (Red Hat package): 3.30.6-2.el8 - 3.30.6-3.el8

gnome-shell (Red Hat package): 3.32.2-9.el8 - 3.32.2-14.el8

gnome-online-accounts (Red Hat package): 3.28.2-1.el8

gnome-boxes (Red Hat package): 3.28.5-7.el8 - 3.28.5-8.el8

gjs (Red Hat package): 1.56.2-3.el8 - 1.56.2-4.el8

gdm (Red Hat package): 3.28.3-22.el8 - 3.28.3-29.el8

accountsservice (Red Hat package): 0.6.50-7.el8 - 0.6.50-8.el8

glib2 (Red Hat package): 2.56.4-7.el8 - 2.56.4-8.el8

Red Hat CodeReady Linux Builder for ARM 64: 8.0

Red Hat CodeReady Linux Builder for Power, little endian: 8.0

Red Hat CodeReady Linux Builder for x86_64: 8.0

gvfs (Red Hat package): 1.36.2-6.el8

gnome-shell-extensions (Red Hat package): 3.32.1-10.el8

chrome-gnome-shell (Red Hat package): 10.1-6.el8

Red Hat Enterprise Linux for ARM 64: 8

Red Hat Enterprise Linux for Power, little endian: 8

Red Hat Enterprise Linux for IBM z Systems: 8

Red Hat Enterprise Linux for x86_64: 8.0

libsass (Red Hat package): before 3.4.5-6.el8

gtk-doc (Red Hat package): before 1.28-3.el8

woff2 (Red Hat package): before 1.0.2-5.el8

soundtouch (Red Hat package): before 2.0.0-3.el8

pangomm (Red Hat package): before 2.40.1-6.el8

libvisual (Red Hat package): before 0.4.0-25.el8

20 (Red Hat package): before 2.10.0-6.el8

libepubgen (Red Hat package): before 0.1.0-3.el8

libdazzle (Red Hat package): before 3.28.5-2.el8

gtkmm30 (Red Hat package): before 3.22.2-3.el8

gtkmm24 (Red Hat package): before 2.24.5-6.el8

gtk2 (Red Hat package): before 2.24.32-5.el8

gnome-photos (Red Hat package): before 3.28.1-4.el8

glibmm24 (Red Hat package): before 2.56.0-2.el8

geocode-glib (Red Hat package): before 3.26.0-3.el8

geoclue2 (Red Hat package): before 2.5.5-2.el8

gamin (Red Hat package): before 0.1.10-32.el8

enchant2 (Red Hat package): before 2.2.3-3.el8

dleyna-server (Red Hat package): before 0.6.0-3.el8

dleyna-core (Red Hat package): before 0.6.0-3.el8

cairomm (Red Hat package): before 1.12.0-8.el8

atkmm (Red Hat package): before 2.24.2-7.el8

OpenEXR (Red Hat package): before 2.2.0-12.el8

External links

http://access.redhat.com/errata/RHSA-2021:1586

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.