EL
Product
Enterprise Linux Server Tus
On CISA KEVExploited in the wildRansomware-linked
765
CVEs
21
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 106High 264Medium 130Low 0
Watch
Add Enterprise Linux Server Tus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-5208 | 8.8 | Aug 22 | Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which… Affected: 7.3; 7.6 |
| CVE-2017-9462 | 8.8 | Jun 6 | In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a… Affected: 7.3; 7.6 |
| CVE-2016-7545 | 8.8 | Jan 19 | SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call Affected: 7.3 |
| CVE-2016-3710 | 8.8 | May 11 | The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by… Affected: 7.2; 7.3; 7.6; 7.7 |
| CVE-2014-1531 | 8.8 | Apr 30 | Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5,… Affected: 6.5 |
| CVE-2014-1529 | 8.8 | Apr 30 | The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1518 | 8.8 | Apr 30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow… Affected: 6.5 |
| CVE-2014-1513 | 8.8 | Mar 19 | TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition… Affected: 6.5 |
| CVE-2014-1509 | 8.8 | Mar 19 | Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and… Affected: 6.5 |
| CVE-2014-1497 | 8.8 | Mar 19 | The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote… Affected: 6.5 |
| CVE-2014-1482 | 8.8 | Feb 6 | RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which… Affected: 6.5 |
| CVE-2022-2601 | 8.6 | Dec 14 | A buffer overflow was found in grub_font_construct_glyph() Affected: 8.2 |
| CVE-2014-0144 | 8.6 | Sep 29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused… Affected: 6.5 |
| CVE-2018-18284 | 8.6 | Oct 19 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator Affected: 7.6 |
| CVE-2018-17961 | 8.6 | Oct 15 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup Affected: 7.6 |
| CVE-2015-1779 | 8.6 | Jan 12 | The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers… Affected: 7.3; 7.6; 7.7 |
| CVE-2016-2857 | 8.4 | Apr 12 | The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length… Affected: 7.3; 7.6; 7.7 |
| CVE-2018-3169 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.6 |
| CVE-2018-3149 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.6 |
| CVE-2018-2814 | 8.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.6 |
| CVE-2018-2633 | 8.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.4; 7.6 |
| CVE-2017-10116 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-10074 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2021-20233 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.4; 7.6; 7.7; 8.2 |
| CVE-2020-25632 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.4; 7.6; 7.7; 8.2 |
| CVE-2019-8308 | 8.2 | Feb 12 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file Affected: 7.6 |
| CVE-2018-11806 | 8.2 | Jun 13 | m_cat in slirp/mbuf.c in Qemu has a heap-based buffer overflow via incoming fragmented datagrams Affected: 7.6; 7.7 |
| CVE-2020-25717 | 8.1 | Feb 18 | A flaw was found in the way Samba maps domain users to local users Affected: 8.4 |
| CVE-2020-2604 | 8.1 | Jan 15 | Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization) Affected: 7.7 |
| CVE-2018-1311 | 8.1 | Dec 18 | The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs Affected: 7.7 |
| CVE-2019-9506 | 8.1 | Aug 14 | The Bluetooth BR/EDR specification up to and including version 5.1 permits sufficiently low encryption key length and does not prevent an attacker from influencing the key length… Affected: 7.3; 7.4; 7.6; 7.7; 8.2; 8.4 |
| CVE-2019-13616 | 8.1 | Jul 16 | SDL (Simple DirectMedia Layer) through 1.2.15 and 2.x through 2.0.9 has a heap-based buffer over-read in BlitNtoN in video/SDL_blit_N.c when called from SDL_SoftBlit in… Affected: 7.7 |
| CVE-2019-2698 | 8.1 | Apr 23 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D) Affected: 8.2; 8.4; 8.6 |
| CVE-2019-3878 | 8.1 | Mar 26 | A vulnerability was found in mod_auth_mellon before v0.14.2 Affected: 7.6 |
| CVE-2019-6974 | 8.1 | Feb 15 | In the Linux kernel before 4.20.8, kvm_ioctl_create_device in virt/kvm/kvm_main.c mishandles reference counting because of a race condition, leading to a use-after-free Affected: 7.4; 7.6 |
| CVE-2018-18559 | 8.1 | Oct 22 | In the Linux kernel through 4.19, a use-after-free can occur due to a race condition between fanout_add from setsockopt and bind on an AF_PACKET socket Affected: 7.6 |
| CVE-2018-12386 | 8.1 | Oct 18 | A vulnerability in register allocation in JavaScript can lead to type confusion, allowing for an arbitrary read and write Affected: 7.6 |
| CVE-2018-5178 | 8.1 | Jun 11 | A buffer overflow was found during UTF8 to Unicode string conversion within JavaScript with extremely large amounts of data Affected: 7.6 |
| CVE-2017-0902 | 8.1 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a… Affected: 7.4; 7.6 |
| CVE-2017-10078 | 8.1 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Scripting) Affected: 7.3; 7.6; 7.7 |
| CVE-2016-5387 | 8.1 | Jul 19 | The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY… Affected: 7.2; 7.3; 7.6; 7.7 |
| CVE-2016-5388 | 8.1 | Jul 19 | Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the… Affected: 7.2 |
| CVE-2016-1762 | 8.1 | Mar 24 | The xmlNextChar function in libxml2 before 2.9.4 allows remote attackers to cause a denial of service (heap-based buffer over-read) via a crafted XML document Affected: 7.2; 7.3; 7.6 |
| CVE-2017-1000251 | 8.0 | Sep 12 | The native Bluetooth stack in the Linux Kernel (BlueZ), starting at the Linux kernel version 2.6.32 and up to and including 4.13.1, are vulnerable to a stack overflow… Affected: 6.5; 6.6; 7.2; 7.3; 7.4; 7.6; +1 more |
| CVE-2026-4775 | 7.8 | Mar 24 | Libtiff: libtiff: arbitrary code execution or denial of service via signed integer overflow in tiff file processing Affected: 8.6; 8.8 |
| CVE-2023-3972 | 7.8 | Nov 1 | A vulnerability was found in insights-client Affected: 8.2; 8.4; 8.6; 8.8 |
| CVE-2023-5633 | 7.8 | Oct 23 | The reference count changes made as part of the CVE-2023-33951 and CVE-2023-33952 fixes exposed a use-after-free flaw in the way memory objects were handled when they were being… Affected: 8.8 |
| CVE-2023-3899 | 7.8 | Aug 23 | A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization Affected: 8.2; 8.4; 8.6; 8.8 |
| CVE-2023-2491 | 7.8 | May 17 | A flaw was found in the Emacs text editor Affected: 8.8 |
| CVE-2023-0494 | 7.8 | Mar 27 | A vulnerability was found in X.Org Affected: 8.2; 8.4; 8.6 |
The 500 most important CVEs for this product (exploited first, then by severity)