EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-3137 | 7.5 | Jan 16 | A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME Affected: 6.7; 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-5740 | 7.5 | Jan 16 | A flaw in the "deny-answer-aliases" feature can cause an assertion failure in named Affected: 7.5; 7.6 |
| CVE-2018-5733 | 7.5 | Jan 16 | A malicious client can overflow a reference counter in ISC dhcpd Affected: 7.4; 7.5; 7.6 |
| CVE-2017-3145 | 7.5 | Jan 16 | Improper fetch cleanup sequencing in the resolver can cause named to crash Affected: 6.7; 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-3144 | 7.5 | Jan 16 | Failure to properly clean up closed OMAPI connections can exhaust available sockets Affected: 7.4; 7.5; 7.6 |
| CVE-2018-14638 | 7.5 | Sep 14 | A flaw was found in 389-ds-base before version 1.3.8.4-13 Affected: 7.5; 7.6 |
| CVE-2018-5391 | 7.5 | Sep 6 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly Affected: 6.7; 7.3; 7.4; 7.5 |
| CVE-2018-14624 | 7.5 | Sep 6 | A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16 Affected: 7.5; 7.6 |
| CVE-2018-14622 | 7.5 | Aug 30 | A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3 Affected: 7.4; 7.5; 7.6 |
| CVE-2018-10915 | 7.5 | Aug 9 | A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections Affected: 7.5 |
| CVE-2018-5390 | 7.5 | Aug 6 | Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service Affected: 6.4; 6.7; 7.2; 7.3; 7.4; 7.5 |
| CVE-2016-9578 | 7.5 | Jul 27 | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling Affected: 7.3; 7.4; 7.5 |
| CVE-2018-5184 | 7.5 | Jun 11 | Using remote content in encrypted messages can lead to the disclosure of plaintext Affected: 7.5; 7.6 |
| CVE-2018-5162 | 7.5 | Jun 11 | Plaintext of decrypted emails can leak through the src attribute of remote images, or links Affected: 7.5; 7.6 |
| CVE-2018-5157 | 7.5 | Jun 11 | Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer Affected: 7.5; 7.6 |
| CVE-2017-7843 | 7.5 | Jun 11 | When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely Affected: 7.4; 7.5 |
| CVE-2017-7803 | 7.5 | Jun 11 | When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored Affected: 7.4; 7.5 |
| CVE-2017-7787 | 7.5 | Jun 11 | Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to… Affected: 7.3; 7.4; 7.5 |
| CVE-2017-7754 | 7.5 | Jun 11 | An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5455 | 7.5 | Jun 11 | The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in… Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5454 | 7.5 | Jun 11 | A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of… Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5449 | 7.5 | Jun 11 | A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5445 | 7.5 | Jun 11 | A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5444 | 7.5 | Jun 11 | A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data Affected: 7.3; 7.4; 7.5 |
| CVE-2017-5378 | 7.5 | Jun 11 | Hashed codes of JavaScript objects are shared between pages Affected: 7.3; 7.4; 7.5 |
| CVE-2016-9902 | 7.5 | Jun 11 | The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events Affected: 7.3; 7.4; 7.5 |
| CVE-2016-9900 | 7.5 | Jun 11 | External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs Affected: 7.3; 7.4; 7.5 |
| CVE-2018-12020 | 7.5 | Jun 8 | mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on… Affected: 7.5; 7.6 |
| CVE-2018-1086 | 7.5 | Apr 12 | pcs before versions 0.9.164 and 0.10 is vulnerable to a debug parameter removal bypass Affected: 7.5; 7.6 |
| CVE-2018-5748 | 7.5 | Jan 25 | qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply Affected: 7.5; 7.6 |
| CVE-2017-1000410 | 7.5 | Dec 7 | The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages Affected: 7.4; 7.6 |
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2017-1000115 | 7.5 | Oct 5 | Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository Affected: 7.4; 7.5; 7.6 |
| CVE-2017-0901 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem Affected: 7.4; 7.5; 7.6 |
| CVE-2017-0900 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query`… Affected: 7.4; 7.5; 7.6 |
| CVE-2015-7704 | 7.5 | Aug 7 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages Affected: 6.5; 6.6; 6.7; 7.1; 7.3; 7.4; +3 more |
| CVE-2015-7701 | 7.5 | Aug 7 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2015-7692 | 7.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2015-7691 | 7.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2015-7703 | 7.5 | Jul 24 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2015-5300 | 7.5 | Jul 21 | The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote… Affected: 6.7.z; 7.1 |
| CVE-2017-10978 | 7.5 | Jul 17 | An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-3302 | 7.5 | Feb 12 | Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through… Affected: 7.4; 7.5; 7.6 |
| CVE-2016-7426 | 7.5 | Jan 13 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-5418 | 7.5 | Sep 21 | The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a… Affected: 7.2 |
| CVE-2016-4809 | 7.5 | Sep 21 | The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service… Affected: 7.2 |
| CVE-2015-4605 | 7.5 | May 16 | The mcopy function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly restrict a… Affected: 7.1 |
| CVE-2015-4604 | 7.5 | May 16 | The mget function in softmagic.c in file 5.x, as used in the Fileinfo component in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, does not properly maintain a… Affected: 7.1 |
| CVE-2016-2109 | 7.5 | May 5 | The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial… Affected: 7.2 |
| CVE-2016-2106 | 7.5 | May 5 | Integer overflow in the EVP_EncryptUpdate function in crypto/evp/evp_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service… Affected: 7.2 |
The 500 most important CVEs for this product (exploited first, then by severity)