EL
Product
Enterprise Linux Hpc Node
On CISA KEVExploited in the wild
146
CVEs
3
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 13High 36Medium 15Low 2
Watch
Add Enterprise Linux Hpc Node to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2015-4021 | – | Jun 9 | The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is… Affected: 7.0 |
| CVE-2015-3330 | – | Jun 9 | The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows… Affected: 7.0 |
| CVE-2015-3329 | – | Jun 9 | Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to… Affected: 7.0 |
| CVE-2015-3307 | – | Jun 9 | The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap… Affected: 7.0 |
| CVE-2015-2783 | – | Jun 9 | ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of… Affected: 7.0 |
| CVE-2015-1863 | – | Apr 28 | Heap-based buffer overflow in wpa_supplicant 1.0 through 2.4 allows remote attackers to cause a denial of service (crash), read memory, or possibly execute arbitrary code via… Affected: 7.0 |
| CVE-2015-0251 | – | Apr 8 | The mod_dav_svn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP… Affected: 6.0 |
| CVE-2015-0248 | – | Apr 8 | The (1) mod_dav_svn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and… Affected: 6 |
| CVE-2015-2787 | – | Mar 30 | Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows… Affected: 7.0 |
| CVE-2015-2348 | – | Mar 30 | The move_uploaded_file implementation in ext/standard/basic_functions.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 truncates a pathname upon encountering a… Affected: 7.0 |
| CVE-2015-2301 | – | Mar 30 | Use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service… Affected: 7.0 |
| CVE-2014-8169 | – | Mar 18 | automount 5.0.8, when a program map uses certain interpreted languages, uses the calling user's USER and HOME environment variable values instead of the values for the user used… Affected: 6.0 |
| CVE-2014-9675 | – | Feb 8 | bdf/bdflib.c in FreeType before 2.5.4 identifies property names by only verifying that an initial substring is present, which allows remote attackers to discover heap pointer… Affected: 6.0; 7.0 |
| CVE-2014-9674 | – | Feb 8 | The Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 proceeds with adding to length values without validating the original values, which allows remote… Affected: 6.0; 7.0 |
| CVE-2014-9673 | – | Feb 8 | Integer signedness error in the Mac_Read_POST_Resource function in base/ftobjs.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (heap-based buffer… Affected: 6.0; 7.0 |
| CVE-2014-9671 | – | Feb 8 | Off-by-one error in the pcf_get_properties function in pcf/pcfread.c in FreeType before 2.5.4 allows remote attackers to cause a denial of service (NULL pointer dereference and… Affected: 6; 7.0 |
| CVE-2014-9670 | – | Feb 8 | Multiple integer signedness errors in the pcf_get_encodings function in pcf/pcfread.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (integer… Affected: 6; 7.0 |
| CVE-2014-9669 | – | Feb 8 | Multiple integer overflows in sfnt/ttcmap.c in FreeType before 2.5.4 allow remote attackers to cause a denial of service (out-of-bounds read or memory corruption) or possibly have… Affected: 6; 7.0 |
| CVE-2014-9667 | – | Feb 8 | sfnt/ttload.c in FreeType before 2.5.4 proceeds with offset+length calculations without restricting the values, which allows remote attackers to cause a denial of service (integer… Affected: 6; 7.0 |
| CVE-2014-9666 | – | Feb 8 | The tt_sbit_decoder_init function in sfnt/ttsbit.c in FreeType before 2.5.4 proceeds with a count-to-size association without restricting the count value, which allows remote… Affected: 6; 7.0 |
| CVE-2014-9664 | – | Feb 8 | FreeType before 2.5.4 does not check for the end of the data during certain parsing actions, which allows remote attackers to cause a denial of service (out-of-bounds read) or… Affected: 6; 7.0 |
| CVE-2014-9663 | – | Feb 8 | The tt_cmap4_validate function in sfnt/ttcmap.c in FreeType before 2.5.4 validates a certain length field before that field's value is completely calculated, which allows remote… Affected: 6; 7.0 |
| CVE-2014-9661 | – | Feb 8 | type42/t42parse.c in FreeType before 2.5.4 does not consider that scanning can be incomplete without triggering an error, which allows remote attackers to cause a denial of… Affected: 6; 7.0 |
| CVE-2014-9660 | – | Feb 8 | The _bdf_parse_glyphs function in bdf/bdflib.c in FreeType before 2.5.4 does not properly handle a missing ENDCHAR record, which allows remote attackers to cause a denial of… Affected: 6; 7.0 |
| CVE-2014-9658 | – | Feb 8 | The tt_face_load_kern function in sfnt/ttkern.c in FreeType before 2.5.4 enforces an incorrect minimum table length, which allows remote attackers to cause a denial of service… Affected: 6; 7.0 |
| CVE-2014-9657 | – | Feb 8 | The tt_face_load_hdmx function in truetype/ttpload.c in FreeType before 2.5.4 does not establish a minimum record size, which allows remote attackers to cause a denial of service… Affected: 6.0; 7.0 |
| CVE-2015-0236 | – | Jan 29 | libvirt before 1.2.12 allow remote authenticated users to obtain the VNC password by using the VIR_DOMAIN_XML_SECURE flag with a crafted (1) snapshot to the… Affected: 7.0 |
| CVE-2015-0432 | – | Jan 21 | Unspecified vulnerability in Oracle MySQL Server 5.5.40 and earlier allows remote authenticated users to affect availability via vectors related to Server : InnoDB : DDL : Foreign… Affected: 7.0 |
| CVE-2014-7300 | – | Dec 25 | GNOME Shell 3.14.x before 3.14.1, when the Screen Lock feature is used, does not limit the aggregate memory consumption of all active PrtSc requests, which allows physically… Affected: 7.0 |
| CVE-2014-8136 | – | Dec 19 | The (1) qemuDomainMigratePerform and (2) qemuDomainMigrateFinish2 functions in qemu/qemu_driver.c in libvirt do not unlock the domain when an ACL check fails, which allow local… Affected: 7.0 |
| CVE-2014-8108 | – | Dec 18 | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer… Affected: 7.0 |
| CVE-2014-3580 | – | Dec 18 | The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer… Affected: 6.0; 7.0 |
| CVE-2014-9273 | – | Dec 8 | lib/handle.c in Hivex before 1.3.11 allows local users to execute arbitrary code and gain privileges via a small hive files, which triggers an out-of-bounds read or write Affected: 6.0 |
| CVE-2012-6662 | – | Nov 24 | Cross-site scripting (XSS) vulnerability in the default content option in jquery.ui.tooltip.js in the Tooltip widget in jQuery UI before 1.10.0 allows remote attackers to inject… Affected: 7.0 |
| CVE-2014-4975 | – | Nov 15 | Off-by-one error in the encodes function in pack.c in Ruby 1.9.3 and earlier, and 2.x through 2.1.2, when using certain format string specifiers, allows context-dependent… Affected: 7.0 |
| CVE-2014-8564 | – | Nov 13 | The _gnutls_ecc_ansi_x963_export function in gnutls_ecc.c in GnuTLS 3.x before 3.1.28, 3.2.x before 3.2.20, and 3.3.x before 3.3.10 allows remote attackers to cause a denial of… Affected: 7.0 |
| CVE-2014-3640 | – | Nov 7 | The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by sending a udp packet with a value of 0 in… Affected: 7.0 |
| CVE-2014-7145 | – | Sep 28 | The SMB2_tcon function in fs/cifs/smb2pdu.c in the Linux kernel before 3.16.3 allows remote CIFS servers to cause a denial of service (NULL pointer dereference and client system… Affected: 7.0 |
| CVE-2014-3528 | – | Aug 19 | Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier… Affected: 6.0; 7.0 |
| CVE-2014-4344 | – | Aug 14 | The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to… Affected: 7.0 |
| CVE-2014-4343 | – | Aug 14 | Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before… Affected: 7.0 |
| CVE-2014-4342 | – | Jul 20 | MIT Kerberos 5 (aka krb5) 1.7.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read or NULL pointer dereference, and application… Affected: 7.0 |
| CVE-2012-6137 | – | May 21 | rhn-migrate-classic-to-rhsm tool in Red Hat subscription-manager does not verify the Red Hat Network Classic server's X.509 certificate when migrating to a Certificate-based Red… Affected: 6 |
| CVE-2012-5689 | – | Jan 25 | ISC BIND 9.8.x through 9.8.4-P1 and 9.9.x through 9.9.2-P1, in certain configurations involving DNS64 with a Response Policy Zone that lacks an AAAA rewrite rule, allows remote… Affected: 6.0 |
| CVE-2012-0867 | – | Jul 18 | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote… Affected: 6.0 |
| CVE-2012-1703 | – | May 3 | Unspecified vulnerability in the MySQL Server component in Oracle MySQL 5.1.61 and earlier, and 5.5.21 and earlier, allows remote authenticated users to affect availability via… Affected: 6.0 |