EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2021-4034 RansomwareIn wildKEV | 7.8 | Jan 28 | Red Hat Polkit Out-of-Bounds Read and Write Vulnerability Affected: 8.4 |
| CVE-2018-14634 In wildKEV | 7.8 | Sep 25 | Linux Kernel Integer Overflow Vulnerability Affected: 6.7; 7.5; 7.6 |
| CVE-2016-9079 In wildKEV | 7.5 | Jun 11 | Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability Affected: 7.3; 7.4; 7.5 |
| CVE-2014-0160 In wildKEV | 7.5 | Apr 7 | OpenSSL Information Disclosure Vulnerability Affected: 6.5 |
| CVE-2012-4512 | 8.8 | Feb 8 | The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a crafted font face… Affected: 6.3 |
| CVE-2019-3856 | 8.8 | Mar 25 | An integer overflow flaw, which could lead to an out of bounds write, was discovered in libssh2 before 1.8.1 in the way keyboard prompt requests are parsed Affected: 7.6 |
| CVE-2019-3857 | 8.8 | Mar 25 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way SSH_MSG_CHANNEL_REQUEST packets with an exit signal are… Affected: 7.6 |
| CVE-2019-3863 | 8.8 | Mar 25 | A flaw was found in libssh2 before 1.8.1 creating a vulnerability on the SSH client side Affected: 7.6 |
| CVE-2019-3855 | 8.8 | Mar 21 | An integer overflow flaw which could lead to an out of bounds write was discovered in libssh2 before 1.8.1 in the way packets are read from the server Affected: 7.6 |
| CVE-2018-12389 | 8.8 | Feb 28 | Mozilla developers and community members reported memory safety bugs present in Firefox ESR 60.2 Affected: 7.5; 7.6 |
| CVE-2018-18356 | 8.8 | Dec 11 | An integer overflow in path handling lead to a use after free in Skia in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to potentially exploit heap corruption via a… Affected: 7.6 |
| CVE-2018-17466 | 8.8 | Nov 14 | Incorrect texture handling in Angle in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page Affected: 7.6 |
| CVE-2018-15688 | 8.8 | Oct 26 | A buffer overflow vulnerability in the dhcp6 client of systemd allows a malicious dhcp6 server to overwrite heap memory in systemd-networkd Affected: 7.6 |
| CVE-2018-12364 | 8.8 | Oct 18 | NPAPI plugins, such as Adobe Flash, can send non-simple cross-origin requests, bypassing CORS by making a same-origin POST that does a 307 redirect to the target site Affected: 7.5; 7.6 |
| CVE-2018-12363 | 8.8 | Oct 18 | A use-after-free vulnerability can occur when script uses mutation events to move DOM nodes between documents, resulting in the old document that held the node being freed but the… Affected: 7.5; 7.6 |
| CVE-2018-12362 | 8.8 | Oct 18 | An integer overflow can occur during graphics operations done by the Supplemental Streaming SIMD Extensions 3 (SSSE3) scaler, resulting in a potentially exploitable crash Affected: 7.5; 7.6 |
| CVE-2018-12360 | 8.8 | Oct 18 | A use-after-free vulnerability can occur when deleting an input element during a mutation event handler triggered by focusing that element Affected: 7.5; 7.6 |
| CVE-2018-12359 | 8.8 | Oct 18 | A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the… Affected: 7.5; 7.6 |
| CVE-2018-1000805 | 8.8 | Oct 8 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE Affected: 6.7; 7.6 |
| CVE-2018-10873 | 8.8 | Aug 17 | A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks Affected: 7.5; 7.6 |
| CVE-2016-9577 | 8.8 | Jul 27 | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling Affected: 7.3; 7.4; 7.5 |
| CVE-2017-12173 | 8.8 | Jul 27 | It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection Affected: 7.4; 7.5 |
| CVE-2018-5158 | 8.8 | Jun 11 | The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file Affected: 7.5; 7.6 |
| CVE-2018-5146 | 8.8 | Jun 11 | An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest Affected: 7.4; 7.5; 7.6 |
| CVE-2018-5130 | 8.8 | Jun 11 | When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered Affected: 7.4; 7.5 |
| CVE-2018-5127 | 8.8 | Jun 11 | A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script Affected: 7.4; 7.5 |
| CVE-2017-7846 | 8.8 | Jun 11 | It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g Affected: 7.4; 7.5 |
| CVE-2017-7798 | 8.8 | Jun 11 | The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code Affected: 7.3; 7.4; 7.5 |
| CVE-2017-7752 | 8.8 | Jun 11 | A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5436 | 8.8 | Jun 11 | An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font Affected: 7.3; 7.4; 7.5 |
| CVE-2014-8129 | 8.8 | Mar 12 | LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by… Affected: 7.2; 7.3; 7.4 |
| CVE-2018-7550 | 8.8 | Mar 1 | The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value… Affected: 7.5; 7.6; 7.7 |
| CVE-2018-6560 | 8.8 | Feb 2 | In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because… Affected: 7.5; 7.6 |
| CVE-2017-17405 | 8.8 | Dec 15 | Ruby before 2.4.3 allows Net::FTP command injection Affected: 7.4; 7.5; 7.6 |
| CVE-2017-5208 | 8.8 | Aug 22 | Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-9462 | 8.8 | Jun 6 | In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-2818 | 8.8 | Jun 13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service… Affected: 7.2 |
| CVE-2016-3710 | 8.8 | May 11 | The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-3069 | 8.8 | Apr 13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository Affected: 7.2 |
| CVE-2016-3068 | 8.8 | Apr 13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository Affected: 7.2 |
| CVE-2014-1531 | 8.8 | Apr 30 | Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5,… Affected: 6.5 |
| CVE-2014-1529 | 8.8 | Apr 30 | The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1518 | 8.8 | Apr 30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow… Affected: 6.5 |
| CVE-2014-1513 | 8.8 | Mar 19 | TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition… Affected: 6.5 |
| CVE-2014-1509 | 8.8 | Mar 19 | Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and… Affected: 6.5 |
| CVE-2014-1497 | 8.8 | Mar 19 | The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote… Affected: 6.5 |
| CVE-2014-1482 | 8.8 | Feb 6 | RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which… Affected: 6.5 |
| CVE-2012-5830 | 8.8 | Nov 21 | Use-after-free vulnerability in Mozilla Firefox before 17.0, Firefox ESR 10.x before 10.0.11, Thunderbird before 17.0, Thunderbird ESR 10.x before 10.0.11, and SeaMonkey before… Affected: 6.3 |
| CVE-2012-0247 | 8.8 | Jun 5 | ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in… Affected: 6.2 |
| CVE-2011-3045 | 8.8 | Mar 22 | Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote… Affected: 6.2 |
The 500 most important CVEs for this product (exploited first, then by severity)