EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-2107 | 5.9 | May 5 | The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to… Affected: 7.2 |
| CVE-2016-0695 | 5.9 | Apr 21 | Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality via vectors related… Affected: 6.7.z; 7.2 |
| CVE-2019-1125 | 5.6 | Sep 3 | An information disclosure vulnerability exists when certain central processing units (CPU) speculatively access memory Affected: 7.7 |
| CVE-2018-3180 | 5.6 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JSSE) Affected: 7.5 |
| CVE-2016-0264 | 5.6 | May 24 | Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40… Affected: 6.7; 7.2; 7.3; 7.4; 7.5 |
| CVE-2021-3659 | 5.5 | Aug 22 | A NULL pointer dereference flaw was found in the Linux kernel’s IEEE 802.15.4 wireless networking subsystem in the way the user closes the LR-WPAN connection Affected: 8.6 |
| CVE-2021-3744 | 5.5 | Mar 4 | A memory leak flaw was found in the Linux kernel in the ccp_run_aes_gcm_cmd() function in drivers/crypto/ccp/ccp-ops.c, which allows attackers to cause a denial of service (memory… Affected: 8.6 |
| CVE-2019-3838 | 5.5 | Mar 25 | It was found that the forceput operator could be extracted from the DefineResource method in ghostscript before 9.27 Affected: 7.6 |
| CVE-2019-3835 | 5.5 | Mar 25 | It was found that the superexec operator was available in the internal dictionary in ghostscript before 9.27 Affected: 7.6 |
| CVE-2019-6454 | 5.5 | Mar 17 | An issue was discovered in sd-bus in systemd 239 Affected: 7.6 |
| CVE-2018-18397 | 5.5 | Dec 12 | The userfaultfd implementation in the Linux kernel before 4.19.7 mishandles access control for certain UFFDIO_ ioctl calls, as demonstrated by allowing local users to write data… Affected: 7.4; 7.5; 7.6 |
| CVE-2018-14646 | 5.5 | Nov 26 | The Linux kernel before 4.15-rc8 was found to be vulnerable to a NULL pointer dereference bug in the __netlink_ns_capable() function in the net/netlink/af_netlink.c file Affected: 7.5; 7.6 |
| CVE-2018-12383 | 5.5 | Oct 18 | If a user saved passwords before Firefox 58 and then later set a master password, an unencrypted copy of these passwords is still accessible Affected: 7.5; 7.6 |
| CVE-2018-17972 | 5.5 | Oct 3 | An issue was discovered in the proc_pid_stack function in fs/proc/base.c in the Linux kernel through 4.18.11 Affected: 7.6 |
| CVE-2018-16542 | 5.5 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use insufficient interpreter stack-size checking during error handling to crash the… Affected: 7.5 |
| CVE-2018-16541 | 5.5 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect free logic in pagedevice replacement to crash the interpreter Affected: 7.6 |
| CVE-2018-16539 | 5.5 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use incorrect access checking in temp file handling to disclose contents of files on… Affected: 7.6 |
| CVE-2015-5160 | 5.5 | Aug 20 | libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-2626 | 5.5 | Jul 27 | It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys Affected: 7.4; 7.5 |
| CVE-2017-2618 | 5.5 | Jul 27 | A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10 Affected: 7.3; 7.4; 7.5 |
| CVE-2017-2625 | 5.5 | Jul 27 | It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys Affected: 7.4; 7.5 |
| CVE-2017-18344 | 5.5 | Jul 26 | The timer_create syscall implementation in kernel/time/posix-timers.c in the Linux kernel before 4.14.8 doesn't properly validate the sigevent->sigev_notify field, which leads to… Affected: 7.3; 7.5 |
| CVE-2018-1000199 | 5.5 | May 24 | The Linux Kernel version 3.18 contains a dangerous feature vulnerability in modify_user_hw_breakpoint() that can result in crash and possibly memory corruption Affected: 7.3; 7.4; 7.5 |
| CVE-2018-1106 | 5.5 | Apr 23 | An authentication bypass flaw has been found in PackageKit before 1.1.10 that allows users without administrator privileges to install signed packages Affected: 7.5; 7.6 |
| CVE-2018-7858 | 5.5 | Mar 12 | Quick Emulator (aka QEMU), when built with the Cirrus CLGD 54xx VGA Emulator support, allows local guest OS privileged users to cause a denial of service (out-of-bounds access and… Affected: 7.5; 7.6 |
| CVE-2016-9591 | 5.5 | Mar 9 | JasPer before version 2.0.12 is vulnerable to a use-after-free in the way it decodes certain JPEG 2000 image files resulting in a crash on the application using JasPer Affected: 7.3; 7.4 |
| CVE-2018-5750 | 5.5 | Jan 26 | The acpi_smbus_hc_add function in drivers/acpi/sbshc.c in the Linux kernel through 4.14.15 allows local users to obtain sensitive address information by reading dmesg data from an… Affected: 7.6 |
| CVE-2017-15121 | 5.5 | Dec 7 | A non-privileged user is able to mount a fuse filesystem on RHEL 6 or 7 and crash a system if an application punches a hole in a file that does not end aligned to a page boundary Affected: 7.6 |
| CVE-2017-3157 | 5.5 | Nov 20 | By exploiting the way Apache OpenOffice before 4.1.4 renders embedded objects, an attacker could craft a document that allows reading in a file from the user's filesystem Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2015-3149 | 5.5 | Jul 25 | The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack Affected: 6.6z; 7.1 |
| CVE-2017-6011 | 5.5 | Feb 16 | An issue was discovered in icoutils 0.31.1 Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-6010 | 5.5 | Feb 16 | An issue was discovered in icoutils 0.31.1 Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-6009 | 5.5 | Feb 16 | An issue was discovered in icoutils 0.31.1 Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-5824 | 5.5 | Jan 27 | libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file Affected: 7.6 |
| CVE-2016-9401 | 5.5 | Jan 23 | popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-7166 | 5.5 | Sep 21 | libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application… Affected: 7.2 |
| CVE-2016-5403 | 5.5 | Aug 2 | The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-4470 | 5.5 | Jun 27 | The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to… Affected: 7.2 |
| CVE-2016-4578 | 5.5 | May 23 | sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensitive information from kernel stack… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1839 | 5.5 | May 20 | The xmlDictAddString function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1838 | 5.5 | May 20 | The xmlPArserPrintFileContextInternal function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1837 | 5.5 | May 20 | Multiple use-after-free vulnerabilities in the (1) htmlPArsePubidLiteral and (2) htmlParseSystemiteral functions in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1836 | 5.5 | May 20 | Use-after-free vulnerability in the xmlDictComputeFastKey function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1833 | 5.5 | May 20 | The htmlCurrentChar function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1, allows remote attackers… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-3712 | 5.5 | May 11 | Integer overflow in the VGA module in QEMU allows local guest OS users to cause a denial of service (out-of-bounds read and QEMU process crash) by editing VGA registers in VBE… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-3717 | 5.5 | May 5 | The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image Affected: 7.2 |
| CVE-2012-0248 | 5.5 | Jun 5 | ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (infinite loop and hang) via a crafted image whose IFD contains IOP tags that all reference… Affected: 6.2 |
| CVE-2017-7823 | 5.4 | Jun 11 | The content security policy (CSP) "sandbox" directive did not create a unique origin for the document, causing it to behave as if the "allow-same-origin" keyword were always… Affected: 7.4; 7.5 |
| CVE-2018-3214 | 5.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Sound) Affected: 7.5 |
| CVE-2018-5168 | 5.3 | Jun 11 | Sites can bypass security checks on permissions to install lightweight themes by manipulating the "baseURI" property of the theme element Affected: 7.5; 7.6 |
The 500 most important CVEs for this product (exploited first, then by severity)