EL
Product
Enterprise Linux Server Eus
On CISA KEVExploited in the wildRansomware-linked
620
CVEs
9
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 150High 216Medium 134Low 0
Watch
Add Enterprise Linux Server Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-2105 | 7.5 | May 5 | Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service… Affected: 7.2 |
| CVE-2015-5229 | 7.5 | Apr 8 | The calloc function in the glibc package in Red Hat Enterprise Linux (RHEL) 6.7 and 7.2 does not properly initialize memory areas, which might allow context-dependent attackers to… Affected: 7.2 |
| CVE-2014-1505 | 7.5 | Mar 19 | The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain… Affected: 6.5 |
| CVE-2014-1487 | 7.5 | Feb 6 | The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1481 | 7.5 | Feb 6 | Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window… Affected: 6.5 |
| CVE-2014-1479 | 7.5 | Feb 6 | The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent… Affected: 6.5 |
| CVE-2017-12151 | 7.4 | Jul 27 | A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3 Affected: 7.4; 7.5 |
| CVE-2018-2637 | 7.4 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JMX) Affected: 7.4; 7.5; 7.6 |
| CVE-2017-1000407 | 7.4 | Dec 11 | The Linux Kernel 2.6.32 and later are affected by a denial of service, by flooding the diagnostic port 0x80 an exception can be triggered leading to a kernel panic Affected: 7.6 |
| CVE-2018-5144 | 7.3 | Jun 11 | An integer overflow can occur during conversion of text to some Unicode character sets due to an unchecked length parameter Affected: 7.2; 7.4; 7.5 |
| CVE-2017-5386 | 7.3 | Jun 11 | WebExtension scripts can use the "data:" protocol to affect pages loaded by other web extensions using this protocol, leading to potential data disclosure or privilege escalation… Affected: 7.3; 7.4; 7.5 |
| CVE-2018-12397 | 7.1 | Feb 28 | A WebExtension can request access to local files without the warning prompt stating that the extension will "Access your data for all websites" being displayed to the user Affected: 7.5 |
| CVE-2016-10165 | 7.1 | Feb 3 | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an image with a crafted… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-2150 | 7.1 | Jun 9 | SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar issue to CVE-2015-5261 Affected: 7.2 |
| CVE-2015-5261 | 7.1 | Jun 7 | Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via guest QXL commands related to surface… Affected: 6.7.z; 7.1 |
| CVE-2018-12385 | 7.0 | Oct 18 | A potentially exploitable crash in TransportSecurityInfo used for SSL can be triggered by data stored in the local cache in the user profile directory Affected: 7.5; 7.6 |
| CVE-2017-10661 | 7.0 | Aug 19 | Race condition in fs/timerfd.c in the Linux kernel before 4.10.15 allows local users to gain privileges or cause a denial of service (list corruption or use-after-free) via… Affected: 7.5 |
| CVE-2018-2634 | 6.8 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JGSS) Affected: 7.4; 7.5; 7.6 |
| CVE-2021-20225 | 6.7 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2020-27749 | 6.7 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.6; 7.7; 8.1 |
| CVE-2019-6133 | 6.7 | Jan 11 | In PolicyKit (aka polkit) 0.115, the "start time" protection mechanism can be bypassed because fork() is not atomic, and therefore authorization decisions are improperly cached Affected: 7.6 |
| CVE-2017-15097 | 6.7 | Jul 27 | Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL Affected: 7.4; 7.5 |
| CVE-2018-1068 | 6.7 | Mar 16 | A flaw was found in the Linux 4.x kernel's implementation of 32-bit syscall interface for bridging Affected: 7.5; 7.6 |
| CVE-2018-14665 | 6.6 | Oct 25 | A flaw was found in xorg-x11-server before 1.20.3 Affected: 7.6 |
| CVE-2017-3600 | 6.6 | Apr 24 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Client mysqldump) Affected: 7.4; 7.5; 7.6 |
| CVE-2015-3147 | 6.5 | Jan 14 | daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to arbitrary files or… Affected: 7.1; 7.2; 7.3; 7.4; 7.5; 7.6; +1 more |
| CVE-2019-10182 | 6.5 | Jul 31 | It was found that icedtea-web though 1.7.2 and 1.8.2 did not properly sanitize paths from <jar/> elements in JNLP files Affected: 7.6 |
| CVE-2018-12396 | 6.5 | Feb 28 | A vulnerability where a WebExtension can run content scripts in disallowed contexts following navigation or other events Affected: 7.6 |
| CVE-2018-18494 | 6.5 | Feb 28 | A same-origin policy violation allowing the theft of cross-origin URL entries when using the Javascript location property to cause a redirection to another site using… Affected: 7.6 |
| CVE-2016-2125 | 6.5 | Oct 31 | It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2018-12366 | 6.5 | Oct 18 | An invalid grid size during QCMS (color profile) transformations can result in the out-of-bounds read interpreted as a float value Affected: 7.5; 7.6 |
| CVE-2018-12365 | 6.5 | Oct 18 | A compromised IPC child process can escape the content sandbox and list the names of arbitrary files on the file system without user consent or interaction Affected: 7.5; 7.6 |
| CVE-2017-2633 | 6.5 | Jul 27 | An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver Affected: 7.4; 7.5 |
| CVE-2018-5185 | 6.5 | Jun 11 | Plaintext of decrypted emails can leak through by user submitting an embedded form Affected: 7.5; 7.6 |
| CVE-2017-7830 | 6.5 | Jun 11 | The Resource Timing API incorrectly revealed navigations in cross-origin iframes Affected: 7.4; 7.5 |
| CVE-2017-5407 | 6.5 | Jun 11 | Using SVG filters that don't use the fixed point math implementation on a target iframe, a malicious page can extract pixel values from a targeted user Affected: 7.3; 7.4; 7.5 |
| CVE-2016-9600 | 6.5 | Mar 12 | JasPer before version 2.0.10 is vulnerable to a null pointer dereference was found in the decoded creation of JPEG 2000 image files Affected: 7.3; 7.4; 7.5; 7.6 |
| CVE-2014-8130 | 6.5 | Mar 12 | The _TIFFmalloc function in tif_unix.c in LibTIFF 4.0.3 does not reject a zero size, which allows remote attackers to cause a denial of service (divide-by-zero error and… Affected: 7.2; 7.3; 7.4 |
| CVE-2018-2582 | 6.5 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.5 |
| CVE-2015-7702 | 6.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-9775 | 6.5 | Jun 22 | Stack buffer overflow in GfxState.cc in pdftocairo in Poppler before 0.56 allows remote attackers to cause a denial of service (application crash) via a crafted PDF document Affected: 7.4; 7.5; 7.6 |
| CVE-2017-9461 | 6.5 | Jun 6 | smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly… Affected: 7.4; 7.5; 7.6 |
| CVE-2016-5844 | 6.5 | Sep 21 | Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file Affected: 7.2 |
| CVE-2015-4598 | 6.5 | May 16 | PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary… Affected: 7.1 |
| CVE-2015-3411 | 6.5 | May 16 | PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read or write to arbitrary… Affected: 7.1 |
| CVE-2014-1523 | 6.5 | Apr 30 | Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote… Affected: 6.5 |
| CVE-2012-1798 | 6.5 | Jun 5 | The TIFFGetEXIFProperties function in coders/tiff.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via a crafted… Affected: 6.2 |
| CVE-2012-0260 | 6.5 | Jun 5 | The JPEGWarningHandler function in coders/jpeg.c in ImageMagick before 6.7.6-3 allows remote attackers to cause a denial of service (memory consumption) via a JPEG image with a… Affected: 6.2 |
| CVE-2018-18073 | 6.3 | Oct 15 | Artifex Ghostscript allows attackers to bypass a sandbox protection mechanism by leveraging exposure of system operators in the saved execution stack in an error object Affected: 7.6 |
| CVE-2017-5466 | 6.1 | Jun 11 | If a page is loaded from an original site through a hyperlink and contains a redirect to a "data:text/html" URL, triggering a reload will run the reloaded "data:text/html" page… Affected: 7.3; 7.4; 7.5 |
The 500 most important CVEs for this product (exploited first, then by severity)