EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2014-0196 In wildKEV | 5.5 | May 7 | Linux Kernel Race Condition Vulnerability Affected: 6.3 |
| CVE-2018-2634 | 6.8 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS) Affected: 7.4; 7.5; 7.6 |
| CVE-2021-20225 | 6.7 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2020-27749 | 6.7 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2019-6133 | 6.7 | Jan 11 | In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached Affected: 7.6 |
| CVE-2017-15097 | 6.7 | Jul 27 | Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL Affected: 7.4; 7.5 |
| CVE-2018-1068 | 6.7 | Mar 16 | A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging Affected: 7.5; 7.6 |
| CVE-2018-14665 | 6.6 | Oct 25 | A flaw was found in xorg-x11-server before 1.20.3 Affected: 7.6 |
| CVE-2017-3600 | 6.6 | Apr 24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump) Affected: 7.4; 7.5; 7.6 |
| CVE-2015-3147 | 6.5 | Jan 14 | daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or… Affected: 7.1; 7.2; 7.3; 7.4; 7.5; 7.6; +1 more |
| CVE-2019-10182 | 6.5 | Jul 31 | It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files Affected: 7.6 |
| CVE-2018-12396 | 6.5 | Feb 28 | A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events Affected: 7.6 |
| CVE-2018-18494 | 6.5 | Feb 28 | A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using… Affected: 7.6 |
| CVE-2016-2125 | 6.5 | Oct 31 | It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-12366 | 6.5 | Oct 18 | An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value Affected: 7.5; 7.6 |
| CVE-2018-12365 | 6.5 | Oct 18 | A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction Affected: 7.5; 7.6 |
| CVE-2017-2633 | 6.5 | Jul 27 | An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver Affected: 7.4; 7.5 |
| CVE-2018-5185 | 6.5 | Jun 11 | Plaintext of decrypted emails can leak through by user submitting an embedded form Affected: 7.5; 7.6 |
| CVE-2017-7830 | 6.5 | Jun 11 | The Resource Timing API incorrectly revealed navigations in cross-origin iframes Affected: 7.4; 7.5 |
| CVE-2017-5407 | 6.5 | Jun 11 | Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user Affected: 7.3; 7.4; 7.5 |
| CVE-2016-9600 | 6.5 | Mar 12 | JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2014-8130 | 6.5 | Mar 12 | The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and… Affected: 7.2; 7.3; 7.4 |
| CVE-2018-2582 | 6.5 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.5 |
| CVE-2015-7702 | 6.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-9775 | 6.5 | Jun 22 | Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document Affected: 7.4; 7.5; 7.6 |
| CVE-2017-9461 | 6.5 | Jun 6 | smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly… Affected: 7.4; 7.5; 7.6 |
| CVE-2016-5844 | 6.5 | Sep 21 | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file Affected: 7.2 |
| CVE-2015-4598 | 6.5 | May 16 | PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary… Affected: 7.1 |
| CVE-2015-3411 | 6.5 | May 16 | PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary… Affected: 7.1 |
| CVE-2014-1523 | 6.5 | Apr 30 | Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote… Affected: 6.5 |
| CVE-2012-1798 | 6.5 | Jun 5 | The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted… Affected: 6.2 |
| CVE-2012-0260 | 6.5 | Jun 5 | The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a… Affected: 6.2 |
| CVE-2018-18073 | 6.3 | Oct 15 | Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object Affected: 7.6 |
| CVE-2017-5466 | 6.1 | Jun 11 | If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page… Affected: 7.3; 7.4; 7.5 |
| CVE-2016-9895 | 6.1 | Jun 11 | Event handlers on "marquee" elements were executed despite a strict Content Security Policy (CSP) that disallowed inline JavaScript Affected: 7.3; 7.4; 7.5 |
| CVE-2018-5950 | 6.1 | Jan 23 | Cross-site scripting (XSS) vulnerability in the web UI in Mailman before 2.1.26 allows remote attackers to inject arbitrary web script or HTML via a user-options URL Affected: 7.4; 7.5; 7.6 |
| CVE-2018-2641 | 6.1 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT) Affected: 7.4; 7.5; 7.6 |
| CVE-2014-1530 | 6.1 | Apr 30 | The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the… Affected: 6.5 |
| CVE-2011-1776 | 6.1 | Sep 6 | The is_gpt_valid function in fs/partitions/efi.c in the Linux kernel before 2.6.39 does not check the size of an Extensible Firmware Interface (EFI) GUID Partition Table (GPT)… Affected: 5.6 |
| CVE-2018-5683 | 6.0 | Jan 23 | The vga_draw_text function in Qemu allows local OS guest privileged users to cause a denial of service (out-of-bounds read and QEMU process crash) by leveraging improper memory… Affected: 7.6; 7.7 |
| CVE-2018-18506 | 5.9 | Feb 5 | When proxy auto-detection is enabled, if a web server serves a Proxy Auto-Configuration (PAC) file or if a PAC file is loaded locally, this PAC file can specify that requests to… Affected: 7.6 |
| CVE-2017-3143 | 5.9 | Jan 16 | An error in TSIG authentication can permit unauthorized dynamic updates Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-3136 | 5.9 | Jan 16 | An error handling synthesized records could cause an assertion failure when using DNS64 with "break-dnssec yes;" Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-3135 | 5.9 | Jan 16 | Combination of DNS64 and RPZ Can Lead to Crash Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-8635 | 5.9 | Aug 1 | It was found that Diffie Hellman Client key exchange handling in NSS 3.21.x was vulnerable to small subgroup confinement attack Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-10850 | 5.9 | Jun 13 | 389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load Affected: 7.5; 7.6 |
| CVE-2018-5131 | 5.9 | Jun 11 | Under certain circumstances the "fetch()" API can return transient local copies of resources that were sent with a "no-store" or "no-cache" cache header instead of downloading a… Affected: 7.4; 7.5 |
| CVE-2018-1049 | 5.9 | Feb 16 | In systemd prior to 234 a race condition exists between .mount and .automount units such that automount requests from kernel may not be serviced by systemd resulting in kernel… Affected: 7.4; 7.5; 7.6 |
| CVE-2018-2618 | 5.9 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: 7.4; 7.5; 7.6 |
| CVE-2015-7852 | 5.9 | Aug 7 | ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
The 500 most important CVEs for this product (exploited first, then by severity)