RHSA-2025:15827HighCVSS 9.1

Red Hat Security Advisory: updated web-terminal/tooling container image

Published
September 15, 2025
Last Modified
August 23, 2026

🔗 CVE IDs covered (9)

CVE-2025-48384 →CVE-2025-5914 →CVE-2025-8941 →CVE-2025-48385 →CVE-2025-49794 →CVE-2025-49796 →CVE-2025-6020 →CVE-2025-6965 →CVE-2025-7425 →

📋 Description

CVE-2025-5914 — libarchive: Double free at archive_read_format_rar_seek_data() in archive_read_support_format_rar.c CVE-2025-6020 — linux-pam: Linux-pam directory Traversal CVE-2025-6965 — sqlite: Integer Truncation in SQLite CVE-2025-7425 — libxslt: libxml2: Heap Use-After-Free in libxslt caused by atype corruption in xmlAttrPtr CVE-2025-8941 — linux-pam: Incomplete fix for CVE-2025-6020 CVE-2025-48384 — git: Git arbitrary code execution CVE-2025-48385 — git: Git arbitrary file writes CVE-2025-49794 — libxml: Heap use after free (UAF) leads to Denial of service (DoS) CVE-2025-49796 — libxml: Type confusion leads to Denial of service (DoS)

🎯 Affected products2

  • Red Hat Web Terminal 1.12 on RHEL 9
  • web-terminal/web-terminal-tooling-rhel9@sha256:f43507114dbba2dcb8083c107c0db8a2ffa4834d1250155496f3c23fbaf68413_amd64 as a component of Red Hat Web Terminal 1.12 on RHEL 9

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: Disable the `pam_namespace` module if it is not essential for your environment, or carefully review and configure it to avoid operating on any directories or paths that can be influenced or controlled by unprivileged users, such as user home directories or world-writable locations like `/tmp`. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid using --recurse-submodules when cloning repositories from untrusted sources; instead, clone normally and only initialize or update submodules manually after reviewing them. Workaround: There's no available mitigation other than avoid processing untrusted XML documents before updating to the libxml version containing the fix. Workaround: There's no available mitigation other than to avoid processing untrusted XML documents if the user is unable/unwilling to update the library.

🔗 References (12)