EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-9898 | 9.8 | Jun 11 | Use-after-free resulting in potentially exploitable crash when manipulating DOM subtrees in the Editor Affected: 7.3; 7.4; 7.5 |
| CVE-2016-9893 | 9.8 | Jun 11 | Memory safety bugs were reported in Thunderbird 45.5 Affected: 7.3; 7.4; 7.5 |
| CVE-2017-2885 | 9.8 | Apr 24 | An exploitable stack based buffer overflow vulnerability exists in the GNOME libsoup 2.58 Affected: 7.4; 7.5 |
| CVE-2017-17833 | 9.8 | Apr 23 | OpenSLP releases in the 1.0.2 and 1.1.0 code streams have a heap-related memory corruption issue which may manifest itself as a denial-of-service or a remote code-execution… Affected: 7.5; 7.6 |
| CVE-2018-1000140 | 9.8 | Mar 23 | rsyslog librelp version 1.2.14 and earlier contains a Buffer Overflow vulnerability in the checking of x509 certificates from a peer that can result in Remote code execution Affected: 6.7; 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-7750 | 9.8 | Mar 13 | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and… Affected: 6.7 |
| CVE-2018-7225 | 9.8 | Feb 19 | An issue was discovered in LibVNCServer through 0.9.11 Affected: 7.5; 7.6 |
| CVE-2018-5379 | 9.8 | Feb 19 | The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes Affected: 7.4; 7.5; 7.6 |
| CVE-2018-6871 | 9.8 | Feb 9 | LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function Affected: 7.4; 7.5; 7.6 |
| CVE-2018-1000007 | 9.8 | Jan 24 | libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties Affected: 7.4; 7.5 |
| CVE-2015-5740 | 9.8 | Oct 18 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP request smuggling attacks via a… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2015-5739 | 9.8 | Oct 18 | The net/http library in net/textproto/reader.go in Go before 1.4.3 does not properly parse HTTP header keys, which allows remote attackers to conduct HTTP request smuggling… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-0903 | 9.8 | Oct 11 | RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability Affected: 7.4; 7.5; 7.6 |
| CVE-2017-1000116 | 9.8 | Oct 5 | Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks Affected: 7.4; 7.5; 7.6 |
| CVE-2017-0899 | 9.8 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters Affected: 7.4; 7.5; 7.6 |
| CVE-2017-14064 | 9.8 | Aug 31 | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call Affected: 7.4; 7.5; 7.6 |
| CVE-2017-5645 | 9.8 | Apr 17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary… Affected: 7.4; 7.5; 7.6 |
| CVE-2017-5205 | 9.8 | Jan 28 | The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print() Affected: 7.4; 7.5; 7.6 |
| CVE-2017-5204 | 9.8 | Jan 28 | The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print() Affected: 7.4; 7.5; 7.6 |
| CVE-2017-5203 | 9.8 | Jan 28 | The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print() Affected: 7.4; 7.5; 7.6 |
| CVE-2017-5202 | 9.8 | Jan 28 | The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print() Affected: 7.4; 7.5; 7.6 |
| CVE-2016-6662 | 9.8 | Sep 20 | Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-4448 | 9.8 | Jun 9 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-0749 | 9.8 | Jun 9 | The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to… Affected: 7.2 |
| CVE-2015-4643 | 9.8 | May 16 | Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary… Affected: 6.6; 7.1; 7.2; 7.3; 7.4; 7.5; +1 more |
| CVE-2015-4603 | 9.8 | May 16 | The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary… Affected: 7.1 |
| CVE-2015-4602 | 9.8 | May 16 | The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial… Affected: 7.1 |
| CVE-2015-4601 | 9.8 | May 16 | PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type… Affected: 7.1 |
| CVE-2015-4600 | 9.8 | May 16 | The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or… Affected: 7.1 |
| CVE-2015-4599 | 9.8 | May 16 | The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information,… Affected: 7.1 |
| CVE-2016-2108 | 9.8 | May 5 | The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and… Affected: 7.2 |
| CVE-2010-5325 | 9.8 | Apr 15 | Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and… Affected: 6.7.z |
| CVE-2015-0192 | 9.8 | Jul 2 | Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to… Affected: 6.6; 7.1; 7.2; 7.3; 7.4; 7.5 |
| CVE-2014-1532 | 9.8 | Apr 30 | Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird… Affected: 6.5 |
| CVE-2014-1524 | 9.8 | Apr 30 | The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not… Affected: 6.5 |
| CVE-2014-1514 | 9.8 | Mar 19 | vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the… Affected: 6.5 |
| CVE-2014-1511 | 9.8 | Mar 19 | Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified… Affected: 6.5 |
| CVE-2014-1510 | 9.8 | Mar 19 | The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute… Affected: 6.5 |
| CVE-2014-1493 | 9.8 | Mar 19 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow… Affected: 6.5 |
| CVE-2014-1477 | 9.8 | Feb 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow… Affected: 6.5 |
| CVE-2013-6671 | 9.8 | Dec 11 | The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers… Affected: 6.5 |
| CVE-2013-5618 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x… Affected: 6.5 |
| CVE-2013-5616 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and… Affected: 6.5 |
| CVE-2013-5613 | 9.8 | Dec 11 | Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey… Affected: 6.5 |
| CVE-2013-5609 | 9.8 | Dec 11 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow… Affected: 6.5 |
| CVE-2019-9948 | 9.1 | Mar 23 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as… Affected: 8.4 |
| CVE-2018-12387 | 9.1 | Oct 18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout Affected: 7.5; 7.6 |
| CVE-2017-2615 | 9.1 | Jul 3 | Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue Affected: 7.3; 7.4; 7.5 |
| CVE-2017-7758 | 9.1 | Jun 11 | An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use Affected: 7.2; 7.3; 7.4; 7.5 |
| CVE-2017-7753 | 9.1 | Jun 11 | An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data Affected: 7.3; 7.4; 7.5 |
The 500 most important CVEs for this product (exploited first, then by severity)