EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2011-3045 | 8.8 | Mar 22 | Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote… Affected: 6.2 |
| CVE-2018-18284 | 8.6 | Oct 19 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator Affected: 7.6 |
| CVE-2018-17961 | 8.6 | Oct 15 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup Affected: 7.6 |
| CVE-2018-5129 | 8.6 | Jun 11 | A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages Affected: 7.4; 7.5 |
| CVE-2017-5448 | 8.6 | Jun 11 | An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content Affected: 7.3; 7.4; 7.5 |
| CVE-2018-3169 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.5 |
| CVE-2018-3149 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.5 |
| CVE-2018-2814 | 8.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.5; 7.6 |
| CVE-2018-2633 | 8.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.4; 7.5; 7.6 |
| CVE-2021-20233 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2020-25632 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2019-8308 | 8.2 | Feb 12 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file Affected: 7.6 |
| CVE-2019-3878 | 8.1 | Mar 26 | A vulnerability was found in mod_auth_mellon before v0.14.2 Affected: 7.6 |
| CVE-2019-6974 | 8.1 | Feb 15 | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free Affected: 7.6 |
| CVE-2018-18559 | 8.1 | Oct 22 | In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket Affected: 7.6 |
| CVE-2018-12386 | 8.1 | Oct 18 | A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write Affected: 7.5; 7.6 |
| CVE-2016-9573 | 8.1 | Aug 1 | An out-of-bounds read vulnerability was found in OpenJPEG 2.1.2, in the j2k_to_image tool Affected: 7.3; 7.4; 7.5 |
| CVE-2017-2590 | 8.1 | Jul 27 | A vulnerability was found in ipa before 4.4 Affected: 7.3; 7.4; 7.5 |
| CVE-2018-5178 | 8.1 | Jun 11 | A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data Affected: 7.5; 7.6 |
| CVE-2017-7807 | 8.1 | Jun 11 | A mechanism that uses AppCache to hijack a URL in a domain using fallback by serving the files from a sub-path on the domain Affected: 7.3; 7.4; 7.5 |
| CVE-2017-0902 | 8.1 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a… Affected: 7.4; 7.5; 7.6 |
| CVE-2016-5386 | 8.1 | Jul 19 | The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of… Affected: 7.2 |
| CVE-2016-5388 | 8.1 | Jul 19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the… Affected: 7.2 |
| CVE-2016-3698 | 8.1 | Jun 13 | libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which allows remote attackers to conduct… Affected: 7.2 |
| CVE-2016-0376 | 8.1 | Jun 3 | The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40),… Affected: 6.7; 7.2; 7.3; 7.4; 7.5 |
| CVE-2016-0363 | 8.1 | Jun 3 | The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40 (7.0.9.40), 7 R1… Affected: 6.7; 7.2; 7.3; 7.4; 7.5 |
| CVE-2016-1762 | 8.1 | Mar 24 | The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2015-7547 | 8.1 | Feb 18 | Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote… Affected: 7.2 |
| CVE-2017-1000251 | 8.0 | Sep 12 | The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow… Affected: 6.7; 7.2; 7.3; 7.4; 7.5; 7.6; +1 more |
| CVE-2014-8141 | 7.8 | Jan 31 | Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t… Affected: 6.6; 7.1; 7.2; 7.3; 7.4; 7.5; +1 more |
| CVE-2014-8140 | 7.8 | Jan 31 | Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t… Affected: 6.6; 7.1; 7.2; 7.3; 7.4; 7.5; +2 more |
| CVE-2014-8139 | 7.8 | Jan 31 | Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip file in the -t command… Affected: 6.6; 7.1; 7.2; 7.3; 7.4; 7.5; +2 more |
| CVE-2014-7844 | 7.8 | Jan 14 | BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address Affected: 6.6; 7.2; 7.3; 7.4; 7.5; 7.6; +1 more |
| CVE-2019-10216 | 7.8 | Nov 27 | In ghostscript before version 9.50, the .buildfont1 procedure did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions Affected: 7.7 |
| CVE-2019-0155 | 7.8 | Nov 14 | Insufficient access control in a subsystem for Intel (R) processor graphics in 6th, 7th, 8th and 9th Generation Intel(R) Core(TM) Processor Families; Intel(R) Pentium(R) Processor… Affected: 7.5 |
| CVE-2017-5333 | 7.8 | Nov 4 | Integer overflow in the extract_group_icon_cursor_resource function in b/wrestool/extract.c in icoutils before 0.31.1 allows local users to cause a denial of service (process… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-5332 | 7.8 | Nov 4 | The extract_group_icon_cursor_resource in wrestool/extract.c in icoutils before 0.31.1 can access unallocated memory, which allows local users to cause a denial of service… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2019-10168 | 7.8 | Aug 2 | The virConnectBaselineHypervisorCPU() and virConnectCompareHypervisorCPU() libvirt APIs, 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accept an "emulator" argument to specify the… Affected: 7.6 |
| CVE-2019-10167 | 7.8 | Aug 2 | The virConnectGetDomainCapabilities() libvirt API, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, accepts an "emulatorbin" argument to specify the program providing… Affected: 7.6 |
| CVE-2019-10166 | 7.8 | Aug 2 | It was discovered that libvirtd, versions 4.x.x before 4.10.1 and 5.x.x before 5.4.1, would permit readonly clients to use the virDomainManagedSaveDefineXML() API, which would… Affected: 7.6 |
| CVE-2019-6116 | 7.8 | Mar 19 | In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution Affected: 7.6 |
| CVE-2019-7221 | 7.8 | Mar 17 | The KVM implementation in the Linux kernel through 4.20.5 has a Use-after-Free Affected: 7.6 |
| CVE-2018-16865 | 7.8 | Jan 11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when many entries are sent to the… Affected: 7.5; 7.6 |
| CVE-2018-16864 | 7.8 | Jan 11 | An allocation of memory without limits, that could result in the stack clashing with another memory region, was discovered in systemd-journald when a program with long command… Affected: 7.4; 7.6 |
| CVE-2018-19134 | 7.8 | Dec 20 | In Artifex Ghostscript through 9.25, the setpattern operator did not properly validate certain types Affected: 7.6 |
| CVE-2018-9568 | 7.8 | Dec 6 | In sk_clone_lock of sock.c, there is a possible memory corruption due to type confusion Affected: 7.6 |
| CVE-2018-16863 | 7.8 | Dec 3 | It was found that RHSA-2018:2918 did not fully fix CVE-2018-16509 Affected: 7.6 |
| CVE-2018-19477 | 7.8 | Nov 23 | psi/zfjbig2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a JBIG2Decode type confusion Affected: 7.6 |
| CVE-2018-19476 | 7.8 | Nov 23 | psi/zicc.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because of a setcolorspace type confusion Affected: 7.6 |
| CVE-2018-19475 | 7.8 | Nov 23 | psi/zdevice2.c in Artifex Ghostscript before 9.26 allows remote attackers to bypass intended access restrictions because available stack space is not checked when the device… Affected: 7.6 |
The 500 most important CVEs for this product (exploited first, then by severity)