EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9401 | 5.5 | Jan 23 | popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-7166 | 5.5 | Sep 21 | libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application… Affected: 7.2 |
| CVE-2016-5403 | 5.5 | Aug 2 | The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-4470 | 5.5 | Jun 27 | The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to… Affected: 7.2 |
| CVE-2016-4578 | 5.5 | May 23 | sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1839 | 5.5 | May 20 | The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1838 | 5.5 | May 20 | The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1837 | 5.5 | May 20 | Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1836 | 5.5 | May 20 | Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1833 | 5.5 | May 20 | The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-3712 | 5.5 | May 11 | Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-3717 | 5.5 | May 5 | The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image Affected: 7.2 |
| CVE-2012-0248 | 5.5 | Jun 5 | ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference… Affected: 6.2 |
| CVE-2017-7823 | 5.4 | Jun 11 | The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always… Affected: 7.4; 7.5 |
| CVE-2018-3214 | 5.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound) Affected: 7.5 |
| CVE-2018-5168 | 5.3 | Jun 11 | Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element Affected: 7.5; 7.6 |
| CVE-2018-5117 | 5.3 | Jun 11 | If right-to-left text is used in the addressbar with left-to-right alignment, it is possible in some circumstances to scroll this text to spoof the displayed URL Affected: 7.3; 7.4; 7.5 |
| CVE-2017-7848 | 5.3 | Jun 11 | RSS fields can inject new lines into the created email structure, modifying the message body Affected: 7.3; 7.4; 7.5 |
| CVE-2017-7791 | 5.3 | Jun 11 | On pages containing an iframe, the "data:" protocol can be used to create a modal alert that will render over arbitrary domains following page navigation, spoofing of the origin… Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5408 | 5.3 | Jun 11 | Video files loaded video captions cross-origin without checking for the presence of CORS headers permitting such cross-origin use, leading to potential information disclosure for… Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5405 | 5.3 | Jun 11 | Certain response codes in FTP connections can result in the use of uninitialized values for ports in FTP operations Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5383 | 5.3 | Jun 11 | URLs containing certain unicode glyphs for alternative hyphens and quotes do not properly trigger punycode display, allowing for domain name spoofing attacks in the location bar Affected: 7.3; 7.4; 7.5 |
| CVE-2018-2815 | 5.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Serialization) Affected: 7.5; 7.6 |
| CVE-2018-2799 | 5.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JAXP) Affected: 7.5; 7.6 |
| CVE-2018-2798 | 5.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: AWT) Affected: 7.5; 7.6 |
| CVE-2018-2797 | 5.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX) Affected: 7.5; 7.6 |
| CVE-2018-2796 | 5.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Concurrency) Affected: 7.5; 7.6 |
| CVE-2018-2795 | 5.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: 7.5; 7.6 |
| CVE-2018-2657 | 5.3 | Jan 18 | Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Serialization) Affected: 7.5 |
| CVE-2018-2629 | 5.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JGSS) Affected: 7.4; 7.5; 7.6 |
| CVE-2018-2603 | 5.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries) Affected: 7.4; 7.5; 7.6 |
| CVE-2017-3636 | 5.3 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client programs) Affected: 7.5; 7.6 |
| CVE-2016-2518 | 5.3 | Jan 30 | The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2015-3412 | 5.3 | May 16 | PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via… Affected: 7.1 |
| CVE-2018-14650 | 5.0 | Sep 27 | It was discovered that sos-collector does not properly set the default permissions of newly created files, making all files created by the tool readable by any local user Affected: 7.6 |
| CVE-2017-3641 | 4.9 | Aug 8 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML) Affected: 7.5; 7.6 |
| CVE-2016-5440 | 4.9 | Jul 21 | Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-2599 | 4.8 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.4; 7.5; 7.6 |
| CVE-2018-5407 | 4.7 | Nov 15 | Simultaneous Multi-threading (SMT) in processors can enable local users to exploit software vulnerable to timing attacks via a side-channel timing attack on 'port contention' Affected: 7.6 |
| CVE-2017-2616 | 4.7 | Jul 27 | A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes Affected: 7.3; 7.4; 7.5 |
| CVE-2015-4170 | 4.7 | May 2 | Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service… Affected: 7.1 |
| CVE-2018-2602 | 4.5 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: I18n) Affected: 7.4; 7.5; 7.6 |
| CVE-2018-11784 | 4.3 | Oct 4 | When the default servlet in Apache Tomcat versions 9.0.0.M1 to 9.0.11, 8.5.0 to 8.5.33 and 7.0.23 to 7.0.90 returned a redirect to a directory (e.g Affected: 7.6 |
| CVE-2018-5170 | 4.3 | Jun 11 | It is possible to spoof the filename of an attachment and display an arbitrary attachment name Affected: 7.5; 7.6 |
| CVE-2018-5161 | 4.3 | Jun 11 | Crafted message headers can cause a Thunderbird process to hang on receiving the message Affected: 7.5; 7.6 |
| CVE-2017-5451 | 4.3 | Jun 11 | A mechanism to spoof the addressbar through the user interaction on the addressbar and the "onblur" event Affected: 7.3; 7.4; 7.5 |
| CVE-2018-2813 | 4.3 | Apr 19 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL) Affected: 7.5; 7.6 |
| CVE-2018-2678 | 4.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.4; 7.5; 7.6 |
| CVE-2018-2677 | 4.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: AWT) Affected: 7.4; 7.5; 7.6 |
| CVE-2018-2663 | 4.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Libraries) Affected: 7.4; 7.5; 7.6 |
The 500 most important CVEs for this product (exploited first, then by severity)