EL
Product
Enterprise Linux Server
On CISA KEVExploited in the wildRansomware-linked
1,886
CVEs
59
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 263High 233Medium 4Low 0
Watch
Add Enterprise Linux Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-2108 | 9.8 | May 5 | The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and… Affected: 6.0; 7.0 |
| CVE-2010-5325 | 9.8 | Apr 15 | Heap-based buffer overflow in the unhtmlify function in foomatic-rip in foomatic-filters before 4.0.6 allows remote attackers to cause a denial of service (memory corruption and… Affected: 6.0 |
| CVE-2015-8391 | 9.8 | Dec 2 | The pcre_compile function in pcre_compile.c in PCRE before 8.38 mishandles certain [: nesting, which allows remote attackers to cause a denial of service (CPU consumption) or… Affected: 7.0 |
| CVE-2015-0192 | 9.8 | Jul 2 | Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to… Affected: 5.0; 6.0; 7.0 |
| CVE-2014-1532 | 9.8 | Apr 30 | Use-after-free vulnerability in the nsHostResolver::ConditionallyRefreshRecord function in libxul.so in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird… Affected: 5.0; 6.0 |
| CVE-2014-1524 | 9.8 | Apr 30 | The nsXBLProtoImpl::InstallImplementation function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 does not… Affected: 5.0; 6.0 |
| CVE-2014-1514 | 9.8 | Mar 19 | vmtypedarrayobject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not validate the length of the… Affected: 5.0; 6.0 |
| CVE-2014-1511 | 9.8 | Mar 19 | Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the popup blocker via unspecified… Affected: 5.0; 6.0 |
| CVE-2014-1510 | 9.8 | Mar 19 | The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute… Affected: 5.0; 6.0 |
| CVE-2014-1493 | 9.8 | Mar 19 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow… Affected: 5.0; 6.0 |
| CVE-2014-1486 | 9.8 | Feb 6 | Use-after-free vulnerability in the imgRequestProxy function in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24… Affected: 6.0 |
| CVE-2014-1477 | 9.8 | Feb 6 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow… Affected: 5.0; 6.0 |
| CVE-2013-6671 | 9.8 | Dec 11 | The nsGfxScrollFrameInner::IsLTR function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allows remote attackers… Affected: 5.0; 6.0 |
| CVE-2013-5618 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsNodeUtils::LastRelease function in the table-editing user interface in the editor component in Mozilla Firefox before 26.0, Firefox ESR 24.x… Affected: 5.0; 6.0 |
| CVE-2013-5616 | 9.8 | Dec 11 | Use-after-free vulnerability in the nsEventListenerManager::HandleEventSubType function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and… Affected: 5.0; 6.0 |
| CVE-2013-5613 | 9.8 | Dec 11 | Use-after-free vulnerability in the PresShell::DispatchSynthMouseMove function in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey… Affected: 5.0; 6.0 |
| CVE-2013-5609 | 9.8 | Dec 11 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 26.0, Firefox ESR 24.x before 24.2, Thunderbird before 24.2, and SeaMonkey before 2.23 allow… Affected: 5.0; 6.0 |
| CVE-2012-4406 | 9.8 | Oct 22 | OpenStack Object Storage (swift) before 1.7.0 uses the loads function in the pickle Python module unsafely when storing and loading metadata in memcached, which allows remote… Affected: 5.0; 6.0 |
| CVE-2012-3503 | 9.8 | Aug 25 | The installation script in Katello 1.0 and earlier does not properly generate the Application.config.secret_token value, which causes each default installation to have the same… Affected: 6.0 |
| CVE-2010-4203 | 9.8 | Nov 5 | WebM libvpx (aka the VP8 Codec SDK) before 0.9.5, as used in Google Chrome before 7.0.517.44, allows remote attackers to cause a denial of service (memory corruption) or possibly… Affected: 6.0 |
| CVE-2010-2941 | 9.8 | Nov 5 | ipp.c in cupsd in CUPS 1.4.4 and earlier does not properly allocate memory for attribute values with invalid string data types, which allows remote attackers to cause a denial of… Affected: 5.0 |
| CVE-2019-5759 | 9.6 | Feb 19 | Incorrect lifetime handling in HTML select elements in Google Chrome on Android and Mac prior to 72.0.3626.81 allowed a remote attacker to potentially perform a sandbox escape via… Affected: 6.0 |
| CVE-2018-6127 | 9.6 | Jan 9 | Early free of object in use in IndexDB in Google Chrome prior to 67.0.3396.62 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox… Affected: 6.0 |
| CVE-2018-16068 | 9.6 | Jan 9 | Missing validation in Mojo in Google Chrome prior to 69.0.3497.81 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page Affected: 6.0 |
| CVE-2018-6152 | 9.6 | Dec 4 | The implementation of the Page.downloadBehavior backend unconditionally marked downloaded files as safe, regardless of file type in Google Chrome prior to 66.0.3359.117 allowed an… Affected: 6.0 |
| CVE-2018-17472 | 9.6 | Nov 14 | Incorrect handling of googlechrome:// URL scheme on iOS in Intents in Google Chrome prior to 70.0.3538.67 allowed a remote attacker to escape the <iframe> sandbox via a crafted… Affected: 6.0 |
| CVE-2017-5053 | 9.6 | Oct 27 | An out-of-bounds read in V8 in Google Chrome prior to 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code… Affected: 6.0 |
| CVE-2017-10346 | 9.6 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 6.0; 7.0 |
| CVE-2017-10285 | 9.6 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 6.0; 7.0 |
| CVE-2017-10111 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 6.0; 7.0 |
| CVE-2017-10110 | 9.6 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: AWT) Affected: 6.0; 7.0 |
| CVE-2017-10107 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI) Affected: 6.0; 7.0 |
| CVE-2017-10101 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: 6.0; 7.0 |
| CVE-2017-10096 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) Affected: 6.0; 7.0 |
| CVE-2017-10090 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 6.0; 7.0 |
| CVE-2017-10089 | 9.6 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO) Affected: 6.0; 7.0 |
| CVE-2017-10087 | 9.6 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 6.0; 7.0 |
| CVE-2019-17631 | 9.1 | Oct 17 | From Eclipse OpenJ9 0.15 to 0.16, access to diagnostic operations such as causing a GC or creating a diagnostic file are permitted without any privilege checks Affected: 6.0; 7.0 |
| CVE-2019-9948 | 9.1 | Mar 23 | urllib in Python 2.x through 2.7.16 supports the local_file: scheme, which makes it easier for remote attackers to bypass protection mechanisms that blacklist file: URIs, as… Affected: 7.0; 8.0 |
| CVE-2018-12387 | 9.1 | Oct 18 | A vulnerability where the JavaScript JIT compiler inlines Array.prototype.push with multiple arguments that results in the stack pointer being off by 8 bytes after a bailout Affected: 6.0; 7.0 |
| CVE-2017-2615 | 9.1 | Jul 3 | Quick emulator (QEMU) built with the Cirrus CLGD 54xx VGA emulator support is vulnerable to an out-of-bounds access issue Affected: 6.0; 7.0 |
| CVE-2017-7758 | 9.1 | Jun 11 | An out-of-bounds read vulnerability with the Opus encoder when the number of channels in an audio stream changes while the encoder is in use Affected: 6.0; 7.0 |
| CVE-2017-7753 | 9.1 | Jun 11 | An out-of-bounds read occurs when applying style rules to pseudo-elements, such as ::first-line, using cached style data Affected: 6.0; 7.0 |
| CVE-2017-5465 | 9.1 | Jun 11 | An out-of-bounds read while processing SVG content in "ConvolvePixel" Affected: 6.0; 7.0 |
| CVE-2017-5447 | 9.1 | Jun 11 | An out-of-bounds read during the processing of glyph widths during text layout Affected: 6.0; 7.0 |
| CVE-2018-1000301 | 9.1 | May 24 | curl version curl 7.20.0 to and including curl 7.59.0 contains a CWE-126: Buffer Over-read vulnerability in denial of service that can result in curl can be tricked into reading… Affected: 7.0 |
| CVE-2018-1000122 | 9.1 | Mar 14 | A buffer over-read exists in curl 7.20.0 to and including curl 7.58.0 in the RTSP+RTP handling code that allows an attacker to cause a denial of service or information leakage Affected: 7.0 |
| CVE-2016-5018 | 9.1 | Aug 10 | In Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 a malicious web application was able to bypass a configured… Affected: 7.0 |
| CVE-2017-9788 | 9.1 | Jul 13 | In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between… Affected: 6.0; 7.0 |
| CVE-2014-1508 | 9.1 | Mar 19 | The libxul.so!gfxContext::Polygon function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers… Affected: 5.0; 6.0 |
The 500 most important CVEs for this product (exploited first, then by severity)