EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-12379 | 7.8 | Oct 18 | When the Mozilla Updater opens a MAR format file which contains a very long item filename, an out-of-bounds write can be triggered, leading to a potentially exploitable crash Affected: 7.5; 7.6 |
| CVE-2018-18445 | 7.8 | Oct 17 | In the Linux kernel 4.14.x, 4.15.x, 4.16.x, 4.17.x, and 4.18.x before 4.18.13, faulty computation of numeric bounds in the BPF verifier permits out-of-bounds memory accesses… Affected: 7.6 |
| CVE-2018-17183 | 7.8 | Sep 19 | Artifex Ghostscript before 9.25 allowed a user-writable error exception table, which could be used by remote attackers able to supply crafted PostScript to potentially overwrite… Affected: 7.6 |
| CVE-2018-11781 | 7.8 | Sep 17 | Apache SpamAssassin 3.4.2 fixes a local user code injection in the meta rule syntax Affected: 7.5 |
| CVE-2018-16802 | 7.8 | Sep 10 | An issue was discovered in Artifex Ghostscript before 9.25 Affected: 7.6 |
| CVE-2016-7035 | 7.8 | Sep 10 | An authorization flaw was found in Pacemaker before 1.1.16, where it did not properly guard its IPC interface Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-16540 | 7.8 | Sep 5 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files to the builtin PDF14 converter could use a use-after-free in copydevice handling to crash the… Affected: 7.5; 7.6 |
| CVE-2018-16511 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: 7.6 |
| CVE-2018-16509 | 7.8 | Sep 5 | An issue was discovered in Artifex Ghostscript before 9.24 Affected: 7.5 |
| CVE-2018-15911 | 7.8 | Aug 28 | In Artifex Ghostscript 9.23 before 2018-08-24, attackers able to supply crafted PostScript could use uninitialized memory access in the aesdecode operator to crash the interpreter… Affected: 7.6 |
| CVE-2018-15910 | 7.8 | Aug 27 | In Artifex Ghostscript before 9.24, attackers able to supply crafted PostScript files could use a type confusion in the LockDistillerParams parameter to crash the interpreter or… Affected: 7.5 |
| CVE-2018-15909 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-24, a type confusion using the .shfill operator could be used by attackers able to supply crafted PostScript files to crash the… Affected: 7.6 |
| CVE-2018-15908 | 7.8 | Aug 27 | In Artifex Ghostscript 9.23 before 2018-08-23, attackers are able to supply malicious PostScript files to bypass .tempfile restrictions and write files Affected: 7.6 |
| CVE-2016-9583 | 7.8 | Aug 1 | An out-of-bounds heap read vulnerability was found in the jpc_pi_nextpcrl() function of jasper before 2.0.6 when processing crafted input Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-8654 | 7.8 | Aug 1 | A heap-buffer overflow vulnerability was found in QMFB code in JPC codec caused by buffer being allocated with too small size Affected: 7.3; 7.4; 7.5 |
| CVE-2017-7518 | 7.8 | Jul 30 | A flaw was found in the Linux kernel before version 4.12 in the way the KVM module processed the trap flag(TF) bit in EFLAGS during emulation of the syscall instruction, which… Affected: 7.4; 7.5 |
| CVE-2017-7814 | 7.8 | Jun 11 | File downloads encoded with "blob:" and "data:" URL elements bypassed normal file download checks though the Phishing and Malware Protection feature and its block lists of… Affected: 7.4; 7.5 |
| CVE-2018-11235 | 7.8 | May 30 | In Git before 2.13.7, 2.14.x before 2.14.4, 2.15.x before 2.15.2, 2.16.x before 2.16.4, and 2.17.x before 2.17.1, remote code execution can occur Affected: 7.5 |
| CVE-2018-1087 | 7.8 | May 15 | kernel KVM before versions kernel 4.16, kernel 4.16-rc7, kernel 4.17-rc1, kernel 4.17-rc2 and kernel 4.17-rc3 is vulnerable to a flaw in the way the Linux kernel's KVM hypervisor… Affected: 7.3; 7.4; 7.5 |
| CVE-2018-10675 | 7.8 | May 2 | The do_get_mempolicy function in mm/mempolicy.c in the Linux kernel before 4.12.9 allows local users to cause a denial of service (use-after-free) or possibly have unspecified… Affected: 6.7; 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-10194 | 7.8 | Apr 18 | The set_text_distance function in devices/vector/gdevpdts.c in the pdfwrite component in Artifex Ghostscript through 9.22 does not prevent overflows in text-positioning… Affected: 7.5; 7.7 |
| CVE-2018-1000156 | 7.8 | Apr 6 | GNU Patch version 2.7.6 contains an input validation vulnerability when processing patch files, specifically the EDITOR_PROGRAM invocation (using ed) can result in code execution Affected: 6.7; 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-7566 | 7.8 | Mar 30 | The Linux kernel 4.15 has a Buffer Overflow via an SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl write operation to /dev/snd/seq by a local user Affected: 7.5; 7.6 |
| CVE-2018-6927 | 7.8 | Feb 12 | The futex_requeue function in kernel/futex.c in the Linux kernel before 4.14.15 might allow attackers to cause a denial of service (integer overflow) or possibly have unspecified… Affected: 7.6 |
| CVE-2018-6574 | 7.8 | Feb 7 | Go before 1.8.7, Go 1.9.x before 1.9.4, and Go 1.10 pre-releases before Go 1.10rc2 allow "go get" remote command execution during source code build, by leveraging the gcc or clang… Affected: 7.6 |
| CVE-2018-1000001 | 7.8 | Jan 31 | In glibc 2.26 and earlier there is confusion in the usage of getcwd() by realpath() which can be used to write before the destination buffer leading to a buffer underflow and… Affected: 7.6 |
| CVE-2018-5345 | 7.8 | Jan 12 | A stack-based buffer overflow within GNOME gcab through 0.7.4 can be exploited by malicious attackers to cause a crash or, potentially, execute arbitrary code via a crafted .cab… Affected: 7.4; 7.5; 7.6 |
| CVE-2015-7529 | 7.8 | Nov 6 | sosreport in SoS 3.x allows local users to obtain sensitive information from sosreport files or gain privileges via a symlink attack on an archive file in a temporary directory,… Affected: 6.7; 7.2; 7.3; 7.4; 7.5; 7.6; +1 more |
| CVE-2017-1000111 | 7.8 | Oct 5 | Linux kernel: heap out-of-bounds in AF_PACKET sockets Affected: 7.4; 7.5; 7.6 |
| CVE-2017-1000083 | 7.8 | Sep 5 | backend/comics/comics-document.c (aka the comic book backend) in GNOME Evince before 3.24.1 allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR… Affected: 7.4; 7.5; 7.6 |
| CVE-2017-7980 | 7.8 | Jul 25 | Heap-based buffer overflow in Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) 2.8 and earlier allows local guest OS users to execute arbitrary code or cause a denial of… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-9776 | 7.8 | Jun 22 | Integer overflow leading to Heap buffer overflow in JBIG2Stream.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) or… Affected: 7.4; 7.5; 7.6 |
| CVE-2017-1000366 | 7.8 | Jun 19 | glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, causing them to alias, potentially resulting in arbitrary code… Affected: 6.2; 6.5; 6.7; 7.2; 7.3; 7.4; +2 more |
| CVE-2016-4302 | 7.8 | Sep 21 | Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR… Affected: 7.2 |
| CVE-2016-4300 | 7.8 | Sep 21 | Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip… Affected: 7.2 |
| CVE-2016-0758 | 7.8 | Jun 27 | Integer overflow in lib/asn1_decoder.c in the Linux kernel before 4.6 allows local users to gain privileges via crafted ASN.1 data Affected: 7.2 |
| CVE-2015-5260 | 7.8 | Jun 7 | Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU-KVM crash) or possibly execute… Affected: 6.7.z; 7.1 |
| CVE-2016-1840 | 7.8 | May 20 | Heap-based buffer overflow in the xmlFAParsePosCharGroup function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2016-1834 | 7.8 | May 20 | Heap-based buffer overflow in the xmlStrncat function in libxml2 before 2.9.4, as used in Apple iOS before 9.3.2, OS X before 10.11.5, tvOS before 9.2.1, and watchOS before 2.2.1,… Affected: 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-2794 | 7.7 | Apr 19 | Vulnerability in the Java SE, JRockit component of Oracle Java SE (subcomponent: Security) Affected: 7.5; 7.6 |
| CVE-2020-25647 | 7.6 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2020-27779 | 7.5 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2020-14372 | 7.5 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled Affected: 7.6; 7.7; 8.1 |
| CVE-2019-10171 | 7.5 | Aug 2 | It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5 Affected: 7.5 |
| CVE-2018-16871 | 7.5 | Jul 30 | A flaw was found in the Linux kernel's NFS implementation, all versions 3.x and all versions 4.x up to 4.20 Affected: 7.6 |
| CVE-2017-3139 | 7.5 | Apr 9 | A denial of service flaw was found in the way BIND handled DNSSEC validation Affected: 6.7 |
| CVE-2019-3816 | 7.5 | Mar 14 | Openwsman, versions up to and including 2.6.9, are vulnerable to arbitrary file disclosure because the working directory of openwsmand daemon was set to root directory Affected: 7.6 |
| CVE-2018-12395 | 7.5 | Feb 28 | By rewriting the Host: request headers using the webRequest API, a WebExtension can bypass domain restrictions through domain fronting Affected: 7.5 |
| CVE-2018-12393 | 7.5 | Feb 28 | A potential vulnerability was found in 32-bit builds where an integer overflow during the conversion of scripts to an internal UTF-16 representation could result in allocating a… Affected: 7.6 |
| CVE-2019-3813 | 7.5 | Feb 4 | Spice, versions 0.5.2 through 0.14.1, are vulnerable to an out-of-bounds read due to an off-by-one error in memslot_get_virt Affected: 7.6 |
The 500 most important CVEs for this product (exploited first, then by severity)