Red Hat Linux Security Advisories & CVEs
6057 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-15712] HTTP/2 GOAWAY frame parsing heap buffer over-read via invalid NUL-termination assumption
A heap buffer over-read vulnerability was discovered in libsoup's (versions: libsoup 3.0 to 3.7.0) HTTP/2 connection tracking framework. When the library processes an HTTP/2 GOAWAY frame, it improperly handles the "Additional Debug Data" payload by assuming the data stream is a safely NUL-terminated C-string. Because the parser lacks strict length-boundary verification before reading this data, a remote, unauthenticated attacker can intentionally send a malformed GOAWAY frame missing the appropriate null delimiter. This causes the library to read past the end of the allocated buffer, triggering an application crash that results in a denial of service (DoS), or potentially exposing fragments of memory contents. This vulnerability poses a moderate impact to system confidentiality and availability for software implementations leveraging libsoup for HTTP/2 client or server communications. An unauthenticated network adversary can manipulate frame characteristics to force memory parsing out-of-bounds without requiring special system privileges or user interaction. While primarily resulting in a denial of service via a segmentation fault, the risk of data exposure from adjacent heap allocations places this as a notable security boundary failure within the protocol decoding stack. Red Hat severity: Low — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-125.
Medium [CVE-2026-59888] com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records
jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21.4, and 3.1.4, Java Records using a PropertyNamingStrategy can bypass @JsonIgnore because POJOPropertiesCollector._removeUnwantedIgnorals() records an ignored component under its original implicit name before _renameUsing() applies the naming strategy, allowing the renamed JSON key to be assigned to the Record constructor parameter. This issue is fixed in versions 2.18.8, 2.21.4, and 3.1.4. Consequently, an untrusted client could set internal or privileged components from external input, potentially leading to unauthorized modification or disclosure of sensitive data. Moderate impact. This flaw in jackson-databind allows an attacker to bypass the @JsonIgnore annotation when deserializing Java Records that utilize a PropertyNamingStrategy. Red Hat products using affected versions of jackson-databind for deserialization of external input into Java Records with PropertyNamingStrategy are susceptible. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N). Weakness: CWE-915. Affected products named by the advisory: Red Hat AMQ Broker 7.13.6; Red Hat AI Inference Server 3.3; Red Hat Lightspeed (formerly Insights) for Runtimes 1.0; Red Hat OpenShift Dev Spaces 3.30; and 10 more.
Medium [CVE-2026-59884] Denial of Service via crafted BER input
pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER decoder shared by the CER and DER codecs parses long-form tags by accumulating continuation octets without an upper bound on the tag ID size, allowing a crafted input to force construction of an arbitrarily large integer with CPU cost growing quadratically and to trigger unhandled ValueError exceptions in Python 3.11+ error formatting paths. Any application decoding untrusted BER, CER, or DER input is affected. This issue is fixed in version 0.6.4. A remote attacker can exploit this by providing a specially crafted input, leading to the construction of an arbitrarily large integer. A flaw was found in pyasn1's BER decoder. Many common uses of pyasn1 involve parsing trusted certificates or local configuration and are not exposed to this flaw. The realistic impact is a denial-of-service of the consuming Python process, with automatic recovery in typical service deployments. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected products named by the advisory: Red Hat AI Inference Server 3.3; Red Hat Enterprise Linux AI 3.3; Red Hat Hardened Images; Red Hat OpenShift AI 3.3; and 30 more. Affected products named by the advisory: Red Hat OpenShift AI 3.4; Exploit Intelligence; Lightspeed Core; Migration Toolkit for Applications 8; and 26 more.
Medium [CVE-2026-59198] Information disclosure via TGA RLE encoder out-of-bounds read
Pillow is a Python imaging library. From 5.2.0 until 12.3.0, Pillow's TGA RLE encoder reads past its packed row buffer when saving a mode 1 image with TGA RLE compression, allowing adjacent process heap bytes to be copied into the generated TGA file. This issue is fixed in version 12.3.0. This out-of-bounds read allows adjacent process heap memory to be copied into the generated TGA file, potentially leading to information disclosure. Exploitation requires the application to save attacker-influenced images in TGA format with RLE compression, which is an uncommon operation in affected Red Hat products. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:L). Weakness: CWE-125. Affected Red Hat products: Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3. Under investigation: Exploit Intelligence; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Satellite 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-59203] Denial of Service via crafted EPS file
Pillow is a Python imaging library. From 12.0.0 through 12.2.0, Pillow's EPS parser in PIL/EpsImagePlugin.py accepts a negative byte count in the %%BeginBinary directive, allowing a crafted EPS file to cause Image.open() to seek backwards to the same directive and parse it repeatedly in an infinite loop. This issue is fixed in version 12.3.0. A remote attacker could exploit this vulnerability by providing a specially crafted Encapsulated PostScript (EPS) file. The EPS parser incorrectly handles negative byte counts, causing the system to enter an infinite loop when processing the file. This can lead to a Denial of Service (DoS), making the affected system unresponsive. The impact is limited to denial of service via an infinite parsing loop. Exploitation requires the application to open a crafted EPS file, but does not lead to memory corruption or code execution. Red Hat severity: Moderate — CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-835. Affected Red Hat products: Lightspeed Core; OpenShift Lightspeed; Red Hat AI Inference Server; Red Hat Enterprise Linux AI (RHEL AI) 3; Red Hat OpenShift AI (RHOAI); Red Hat Quay 3. Under investigation: Exploit Intelligence; Red Hat Ansible Automation Platform 2; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Satellite 6. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-15392] DBD::File: Arbitrary file read/write via symlink vulnerability
DBD::File versions before 1.651 for Perl do not ensure the table file is not a symlink to an untrusted location. The complete_table_name method builds the absolute table file path without checking whether the file is a symbolic link. A link inside the data directory can point to a table file at any path outside of the configured f_dir and f_dir_search directories. Callers of file-based drivers can read or write files outside of the data directory. This oversight allows a local attacker to create a symbolic link within the data directory that points to an arbitrary file outside of the intended data storage. Consequently, file-based drivers can be tricked into reading from or writing to unauthorized files, potentially leading to information disclosure or data corruption. This Moderate flaw in DBD::File allows a local attacker to achieve arbitrary file read and write access. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L). Weakness: CWE-59. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: perl-dbi.
Medium [CVE-2026-15697] Remote object prototype pollution
A vulnerability was found in svgdotjs svg.js up to 3.2.5. Performing a manipulation results in improperly controlled modification of object prototype attributes. The attack may be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet. A remote attacker could exploit a vulnerability in the `EventTarget.on` function, which improperly controls modifications to object prototype attributes. This could allow an attacker to manipulate object properties, potentially leading to unintended behavior or data alteration within the application. The impact is limited to the console and requires prior authentication. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-915. Affected Red Hat products: Multicluster Engine for Kubernetes; Red Hat Advanced Cluster Management for Kubernetes 2. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-15043] DBI::SQL::Nano: DBI::SQL::Nano: Incorrect SQL operator evaluation can lead to incorrect data filtering.
DBI::SQL::Nano versions from 1.42 before 1.651 for Perl have inverted = SQL operators on text. DBI::SQL::Nano, DBI's built-in mini-SQL engine, evaluated WHERE predicates incorrectly in some cases. In the non-numeric string branch of the is_matched method, = was evaluated using Perl's le operator. SQL::Nano is the fallback query engine for DBI's file-backed drivers (DBD::File, DBD::DBM, CSV-style drivers) whenever SQL::Statement is not installed, and is forced whenever DBI_SQL_NANO=1. Queries over such tables use these predicates directly. The impact depends on the context. Where an application relies on a WHERE clause to filter file-backed data for policy or authorization, an inverted = comparison silently returns the wrong rows. This vulnerability occurs because the engine incorrectly evaluates SQL operators for text comparisons, specifically inverting the logic for "less than or equal to" and "greater than or equal to" operations. This can lead to applications that rely on these comparisons for filtering data, such as for policy or authorization, silently returning incorrect results. A Moderate impact flaw in perl-DBI's SQL::Nano engine can lead to incorrect data filtering. This issue arises when applications use file-backed drivers with SQL::Nano as the fallback SQL engine, causing text comparison operators (` =`) to be inverted.
Medium [CVE-2026-0716 +1] incomplete fix for CVE-2026-0716: out-of-bounds read in libsoup websocket frame processing (unmasked path)
The fix for CVE-2026-0716 (commit 6ff7ef0, libsoup 3.6.6) placed the integer overflow guard inside the if (masked) block, leaving unmasked server-to-client frames unprotected. A malicious WebSocket server can send a crafted unmasked frame with a payload length near UINT64_MAX to trigger an OOB read in a libsoup-based client when max_incoming_payload_size is set to 0. This vulnerability is rated Moderate for Red Hat because it requires a non-default configuration where max_incoming_payload_size is explicitly set to 0 or unset in libsoup's WebSocket frame processing. In typical Red Hat deployments, this configuration is not enabled by default, limiting the exposure to memory disclosure or application instability. Red Hat severity: Moderate — CVSS 4.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: libsoup3.
Medium [CVE-2026-12482] Arbitrary File Operations via Malicious Tar Archive Processing
A vulnerability in keras-team/keras version 3.12.0 allows an attacker to craft a malicious tar archive that bypasses the `filter_safe_tarinfos` validation in `keras/src/utils/file_utils.py`. Specifically, symlink entries are not subjected to the same `is_path_in_dir` validation as regular file entries, allowing symlinks to be created outside the intended extraction directory. This can lead to symlink-based file read, file overwrite, or directory escape attacks. The issue is particularly impactful on Python 3.10 and 3.11, where `filter_safe_tarinfos` is the sole defense against tar path traversal. This vulnerability is distinct from CVE-2025-12060 and other previously reported issues. A flaw was found in Keras. An attacker can exploit a vulnerability in the tar archive processing to bypass security validations. This allows for the creation of symbolic links (symlinks) outside of the intended directory, which could lead to unauthorized access to or modification of files on the system, or enable an attacker to navigate beyond restricted directories. This Moderate vulnerability in Keras, as used in Red Hat OpenShift AI components, allows an attacker to create arbitrary symlinks outside of the intended extraction directory when processing a specially crafted tar archive. Exploitation requires user interaction and has high attack complexity, which reduces the overall risk.
Medium [CVE-2026-60103] Denial of Service and information disclosure via crafted.blend file
Blender 3.0.0 through 5.1.2 contains an out-of-bounds read vulnerability that allows attackers to trigger a crash or read adjacent heap memory by supplying a crafted.blend file with a malicious signed short member_index value in the SDNA block. The member_index field is used as an array index into the sdna->members[] array in sdna_expand_names() without bounds validation, allowing any value outside the allocated range to produce an invalid pointer subsequently passed to strlen(), resulting in a SIGSEGV crash or unintended heap memory disclosure. A flaw was found in Blender. A remote attacker could exploit an out-of-bounds read vulnerability by providing a specially crafted.blend file. This vulnerability occurs when the application processes a malicious member_index value without proper validation, leading to an attempt to access memory outside of its allocated boundaries. Successful exploitation can result in a denial of service, causing the application to crash, or potentially lead to the disclosure of sensitive information from the system's memory. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Weakness: CWE-125.
Medium [CVE-2026-40468] Memory corruption via integer overflow
Integer overflow vulnerability has been found in "builtin.c" program file of gawk. This issue may lead to memory exhaustion on the hosting operating system and could be used to overwrite gawk heap metadata and objects with attacker-controlled bytes. It affects gawk in versions 5.4.0 and below. A flaw was found in gawk. An integer overflow vulnerability could allow a local attacker to cause memory exhaustion, leading to a denial of service. This flaw may also enable an attacker to corrupt gawk's internal memory, potentially leading to system instability. This could lead to system instability or a denial of service on affected Red Hat products, requiring local access to execute a malicious gawk script. Red Hat severity: Moderate — CVSS 4.4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L). Weakness: CWE-190. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat fixing advisory: RHSA-2026:73429, RHSA-2026:73511, RHSA-2026:73512, RHSA-2026:40041, RHSA-2026:49661. Affected products named by the advisory: Red Hat package: gawk.
Medium [CVE-2026-40467] Denial of Service due to Use After Free vulnerability in io.c
Use After Free vulnerability has been found in "io.c" program file of gawk (do_getline_redir() routine). This issue may lead to a crash. It affects gawk in versions 5.4.0 and below. A flaw was found in gawk. This vulnerability can be triggered by an attacker, potentially leading to a system crash and causing a Denial of Service (DoS). This flaw, affecting gawk in Red Hat Hardened Images, requires a local attacker with low privileges to trick a user into interacting with specially crafted input, limiting its immediate impact. Red Hat severity: Moderate — CVSS 4 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; Red Hat Hardened Images; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat OpenShift Container Platform 4. Will not fix / out of support: Red Hat Enterprise Linux 6. Red Hat fixing advisory: RHSA-2026:73429, RHSA-2026:73511, RHSA-2026:73512, RHSA-2026:40041, RHSA-2026:49661. Affected products named by the advisory: Red Hat package: gawk.
Medium [CVE-2026-62147] Query RBAC bypass
The Tempo Operator's gateway component failed to consistently apply namespace-scoped redaction on some query API response paths when query RBAC was enabled, allowing an authenticated user to read span attributes belonging to other tenants' namespaces. This affects Red Hat OpenShift distributed tracing platform deployments with the Tempo Operator's query RBAC feature enabled prior to tempo-operator.v0.21.0-2, which corrects the gateway's authorization handling; the fix has already shipped to customers via RHSA-2026:33612. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). Weakness: CWE-863. Affected Red Hat products: Red Hat OpenShift distributed tracing 3. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-15538] Remote attacker can modify object prototype attributes
A weakness has been identified in primefaces primereact up to 10.9.8. This issue affects the function ObjectUtils.mutateFieldData of the component API. This manipulation of the argument Field causes improperly controlled modification of object prototype attributes. The attack is possible to be carried out remotely. The project was informed of the problem early through an issue report but has not responded yet. This vulnerability only affects products that are no longer supported by the maintainer. This allows for the improper modification of object prototype attributes, potentially leading to unexpected behavior or further attacks. This Moderate flaw in PrimeFaces PrimeReact allows a remote attacker to modify object prototype attributes through the `ObjectUtils.mutateFieldData` function. Red Hat Enterprise Linux AI components are affected by this vulnerability. Red Hat severity: Moderate — CVSS 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L). Weakness: CWE-915. Affected Red Hat products: Red Hat Enterprise Linux AI (RHEL AI) 3. Red Hat does not currently list a fixing RHSA for this CVE.
Medium [CVE-2026-53364] Fix memory leak in hci_le_big_terminate
In the Linux kernel, the following vulnerability has been resolved: Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() hci_le_big_terminate() allocates iso_list_data via kzalloc_obj but returns 0 without freeing it when neither pa_sync_term nor big_sync_term flags are set after evaluating the PA and BIG sync connection state. This early-return path was introduced when hci_le_big_terminate() was refactored to take struct hci_conn instead of raw u8 parameters, adding PA/BIG flag evaluation logic. The existing kfree() on hci_cmd_sync_queue failure does not cover this path. A flaw was found in the Linux kernel's Bluetooth Host Controller Interface (HCI) connection handling. The `hci_le_big_terminate()` function, which is responsible for terminating Bluetooth connections, allocates memory but fails to free it under specific conditions when certain flags are not set. This memory leak could lead to resource exhaustion, potentially resulting in a denial of service (DoS). Red Hat severity: Low — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-772. Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: kernel-rt.
Medium [CVE-2026-61861] Use-after-free vulnerability leading to denial of service or code execution
ImageMagick before 7.1.2-26 contains a use-after-free vulnerability in the FormatMagickCaption method when memory allocation fails. Attackers can trigger memory allocation failures to cause a dangling pointer to reference freed memory, potentially enabling denial of service or code execution. A flaw was found in ImageMagick. Red Hat severity: Moderate — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-825. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: imagemagick.
Medium [CVE-2026-61465] Denial of Service via crafted image due to missing memory allocation check
ImageMagick before 7.1.2-26 and 6.9.13-51 is missing a check for the allowed memory allocation limit in matrix-backed operations such as -canny. An attacker can supply a crafted image that causes ImageMagick to allocate more memory than permitted by the configured policy, resulting in a denial of service. A flaw was found in ImageMagick. A remote attacker could provide a specially crafted image, causing the software to allocate more memory than permitted by its configuration. This can lead to a denial of service (DoS), making the system or application unavailable to legitimate users. Red Hat severity: Moderate — CVSS 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-770. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: imagemagick.
Medium [CVE-2026-61857] Application crashes via malicious XMP profiles
ImageMagick before 7.1.2-26 contains a heap use-after-free vulnerability caused by missing null check when parsing XMP profiles. Attackers can craft malicious image files with specially crafted XMP data to trigger the vulnerability and cause application crashes. A flaw was found in ImageMagick. This vulnerability allows a remote attacker to cause the application to crash. The issue stems from improper handling of XMP (Extensible Metadata Platform) profiles within image files. By crafting a malicious image with specially designed XMP data, an attacker can trigger a heap use-after-free condition, leading to a denial of service. Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H). Weakness: CWE-476. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: imagemagick.
Medium [CVE-2026-56372] Information Disclosure and Denial of Service
ImageMagick before 7.1.2-19 contains a heap buffer overflow vulnerability in the magnify operation that allows attackers to read out of bounds memory. An unrecognized magnify:method value triggers an out of bounds read, potentially exposing sensitive information or causing denial of service. A flaw was found in ImageMagick. This heap buffer overflow vulnerability, identified as CWE-122 (Heap-based Buffer Overflow), occurs in the magnify operation when processing an unrecognized `magnify:method` value. An attacker could exploit this by providing a specially crafted input, leading to an out-of-bounds read. This could potentially expose sensitive information or cause a denial of service (DoS) to the system. Red Hat severity: Moderate — CVSS 6.1 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:H). Weakness: CWE-125. Affected Red Hat products: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Will not fix / out of support: Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7. Red Hat does not currently list a fixing RHSA for this CVE. Affected products named by the advisory: Red Hat package: imagemagick.