EL
Product
Enterprise Linux Server
On CISA KEVExploited in the wildRansomware-linked
1,886
CVEs
59
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 263High 233Medium 4Low 0
Watch
Add Enterprise Linux Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-5408 | 9.8 | Aug 10 | Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to… Affected: 6.0 |
| CVE-2016-4138 | 9.8 | Jun 16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has… Affected: 5.0; 6.0 |
| CVE-2016-4448 | 9.8 | Jun 9 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors Affected: 6.0; 7.0 |
| CVE-2016-0749 | 9.8 | Jun 9 | The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to… Affected: 6.0; 7.0 |
| CVE-2015-4643 | 9.8 | May 16 | Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary… Affected: 6.0; 7.0 |
| CVE-2015-4603 | 9.8 | May 16 | The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary… Affected: 7.0 |
| CVE-2015-4602 | 9.8 | May 16 | The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial… Affected: 7.0 |
| CVE-2015-4601 | 9.8 | May 16 | PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type… Affected: 7.0 |
| CVE-2015-4600 | 9.8 | May 16 | The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or… Affected: 7.0 |
| CVE-2015-4599 | 9.8 | May 16 | The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information,… Affected: 7.0 |
| CVE-2016-2108 | 9.8 | May 5 | The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and… Affected: 6.0; 7.0 |
| CVE-2010-5325 | 9.8 | Apr 15 | Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and… Affected: 6.0 |
| CVE-2015-8391 | 9.8 | Dec 2 | The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or… Affected: 7.0 |
| CVE-2015-0192 | 9.8 | Jul 2 | Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to… Affected: 5.0; 6.0; 7.0 |
| CVE-2014-1532 | 9.8 | Apr 30 | Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird… Affected: 5.0; 6.0 |
| CVE-2014-1524 | 9.8 | Apr 30 | The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not… Affected: 5.0; 6.0 |
| CVE-2014-1514 | 9.8 | Mar 19 | vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the… Affected: 5.0; 6.0 |
| CVE-2014-1511 | 9.8 | Mar 19 | Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified… Affected: 5.0; 6.0 |
| CVE-2014-1510 | 9.8 | Mar 19 | The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute… Affected: 5.0; 6.0 |
| CVE-2014-1493 | 9.8 | Mar 19 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow… Affected: 5.0; 6.0 |
| CVE-2014-1486 | 9.8 | Feb 6 | Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24… Affected: 6.0 |
| CVE-2014-1477 | 9.8 | Feb 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow… Affected: 5.0; 6.0 |
| CVE-2013-6671 | 9.8 | Dec 11 | The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers… Affected: 5.0; 6.0 |
| CVE-2013-5618 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x… Affected: 5.0; 6.0 |
| CVE-2013-5616 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and… Affected: 5.0; 6.0 |
| CVE-2013-5613 | 9.8 | Dec 11 | Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey… Affected: 5.0; 6.0 |
| CVE-2013-5609 | 9.8 | Dec 11 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow… Affected: 5.0; 6.0 |
| CVE-2012-4406 | 9.8 | Oct 22 | OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote… Affected: 5.0; 6.0 |
| CVE-2012-3503 | 9.8 | Aug 25 | The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same… Affected: 6.0 |
| CVE-2010-4203 | 9.8 | Nov 5 | WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly… Affected: 6.0 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: 5.0 |
| CVE-2019-5759 | 9.6 | Feb 19 | Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via… Affected: 6.0 |
| CVE-2018-6127 | 9.6 | Jan 9 | Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 6.0 |
| CVE-2018-16068 | 9.6 | Jan 9 | Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page Affected: 6.0 |
| CVE-2018-6152 | 9.6 | Dec 4 | The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an… Affected: 6.0 |
| CVE-2018-17472 | 9.6 | Nov 14 | Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sandbox via a crafted… Affected: 6.0 |
| CVE-2017-5053 | 9.6 | Oct 27 | An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code… Affected: 6.0 |
| CVE-2017-10346 | 9.6 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 6.0; 7.0 |
| CVE-2017-10285 | 9.6 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 6.0; 7.0 |
| CVE-2017-10111 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 6.0; 7.0 |
| CVE-2017-10110 | 9.6 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT) Affected: 6.0; 7.0 |
| CVE-2017-10107 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 6.0; 7.0 |
| CVE-2017-10101 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: 6.0; 7.0 |
| CVE-2017-10096 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: 6.0; 7.0 |
| CVE-2017-10090 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 6.0; 7.0 |
| CVE-2017-10089 | 9.6 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO) Affected: 6.0; 7.0 |
| CVE-2017-10087 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 6.0; 7.0 |
| CVE-2019-17631 | 9.1 | Oct 17 | From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks Affected: 6.0; 7.0 |
| CVE-2019-9948 | 9.1 | Mar 23 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as… Affected: 7.0; 8.0 |
| CVE-2018-12387 | 9.1 | Oct 18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout Affected: 6.0; 7.0 |
The 500 most important CVEs for this product (exploited first, then by severity)