EL
Product
Enterprise Linux Workstation
On CISA KEVExploited in the wildRansomware-linked
1,841
CVEs
58
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 251High 245Medium 4Low 0
Watch
Add Enterprise Linux Workstation to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-1000120 | 9.8 | Mar 14 | A buffer overflow exists in curl 7.12.3 to and including curl 7.58.0 in the FTP URL handling that allows an attacker to cause a denial of service or worse Affected: 7.0 |
| CVE-2018-7750 | 9.8 | Mar 13 | transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and… Affected: 6.0 |
| CVE-2018-7225 | 9.8 | Feb 19 | An issue was discovered in LibVNCServer through 0.9.11 Affected: 7.0 |
| CVE-2018-5379 | 9.8 | Feb 19 | The Quagga BGP daemon (bgpd) prior to version 1.2.3 can double-free memory when processing certain forms of UPDATE message, containing cluster-list and/or unknown attributes Affected: 7.0 |
| CVE-2018-6871 | 9.8 | Feb 9 | LibreOffice before 5.4.5 and 6.x before 6.0.1 allows remote attackers to read arbitrary files via =WEBSERVICE calls in a document, which use the COM.MICROSOFT.WEBSERVICE function Affected: 6.0; 7.0 |
| CVE-2018-4877 | 9.8 | Feb 6 | A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161 Affected: 6.0 |
| CVE-2018-6485 | 9.8 | Feb 1 | An integer overflow in the implementation of the posix_memalign in memalign functions in the GNU C Library (aka glibc or libc6) 2.26 and earlier could cause these functions to… Affected: 7.0 |
| CVE-2018-1000007 | 9.8 | Jan 24 | libcurl 7.1 through 7.57.0 might accidentally leak authentication data to third parties Affected: 7.0 |
| CVE-2017-18017 | 9.8 | Jan 3 | The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service… Affected: 6.0; 7.0 |
| CVE-2017-3114 | 9.8 | Dec 9 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions Affected: 6.0 |
| CVE-2017-3112 | 9.8 | Dec 9 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions Affected: 6.0 |
| CVE-2017-11225 | 9.8 | Dec 9 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions Affected: 6.0 |
| CVE-2017-11215 | 9.8 | Dec 9 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions Affected: 6.0 |
| CVE-2017-11213 | 9.8 | Dec 9 | An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions Affected: 6.0 |
| CVE-2017-11282 | 9.8 | Dec 1 | Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser Affected: 6.0 |
| CVE-2017-11281 | 9.8 | Dec 1 | Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function Affected: 6.0 |
| CVE-2017-14746 | 9.8 | Nov 27 | Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request Affected: 6.0; 7.0 |
| CVE-2017-0903 | 9.8 | Oct 11 | RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability Affected: 7.0 |
| CVE-2017-1000116 | 9.8 | Oct 5 | Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks Affected: 7.0 |
| CVE-2017-14491 | 9.8 | Oct 4 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response Affected: 6.0; 7.0 |
| CVE-2017-14493 | 9.8 | Oct 3 | Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request Affected: 7.0 |
| CVE-2017-14492 | 9.8 | Oct 3 | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement… Affected: 7.0 |
| CVE-2017-0899 | 9.8 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications that include terminal escape characters Affected: 7.0 |
| CVE-2017-14064 | 9.8 | Aug 31 | Ruby through 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1 can expose arbitrary memory during a JSON.generate call Affected: 7.0 |
| CVE-2017-3167 | 9.8 | Jun 20 | In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to… Affected: 6.0; 7.0 |
| CVE-2016-7050 | 9.8 | Jun 8 | SerializableProvider in RESTEasy in Red Hat Enterprise Linux Desktop 7, Red Hat Enterprise Linux HPC Node 7, Red Hat Enterprise Linux Server 7, and Red Hat Enterprise Linux… Affected: 7.0 |
| CVE-2016-5405 | 9.8 | Jun 8 | 389 Directory Server in Red Hat Enterprise Linux Desktop 6 through 7, Red Hat Enterprise Linux HPC Node 6 through 7, Red Hat Enterprise Linux Server 6 through 7, and Red Hat… Affected: 6.0; 7.0 |
| CVE-2016-9843 | 9.8 | May 23 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CRC calculation Affected: 6.0; 7.0 |
| CVE-2016-9841 | 9.8 | May 23 | inffast.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic Affected: 6.0; 7.0 |
| CVE-2017-5645 | 9.8 | Apr 17 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary… Affected: 7.0 |
| CVE-2016-1908 | 9.8 | Apr 11 | The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows… Affected: 6.0; 7.0 |
| CVE-2017-5205 | 9.8 | Jan 28 | The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print() Affected: 7.0 |
| CVE-2017-5204 | 9.8 | Jan 28 | The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print() Affected: 7.0 |
| CVE-2017-5203 | 9.8 | Jan 28 | The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print() Affected: 7.0 |
| CVE-2017-5202 | 9.8 | Jan 28 | The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print() Affected: 7.0 |
| CVE-2016-9636 | 9.8 | Jan 27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary… Affected: 6.0 |
| CVE-2016-9635 | 9.8 | Jan 27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary… Affected: 6.0 |
| CVE-2016-9634 | 9.8 | Jan 27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers to execute arbitrary… Affected: 6.0 |
| CVE-2014-8241 | 9.8 | Dec 14 | XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to… Affected: 7.0 |
| CVE-2016-6662 | 9.8 | Sep 20 | Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Percona Server before… Affected: 6.0; 7.0 |
| CVE-2016-5408 | 9.8 | Aug 10 | Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to… Affected: 6.0 |
| CVE-2016-4138 | 9.8 | Jun 16 | Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has… Affected: 5.0; 6.0 |
| CVE-2016-4448 | 9.8 | Jun 9 | Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors Affected: 6.0; 7.0 |
| CVE-2016-0749 | 9.8 | Jun 9 | The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to… Affected: 6.0; 7.0 |
| CVE-2015-4643 | 9.8 | May 16 | Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to execute arbitrary… Affected: 6.0; 7.0 |
| CVE-2015-4603 | 9.8 | May 16 | The exception::getTraceAsString function in Zend/zend_exceptions.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to execute arbitrary… Affected: 7.0 |
| CVE-2015-4602 | 9.8 | May 16 | The __PHP_Incomplete_Class function in ext/standard/incomplete_class.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial… Affected: 7.0 |
| CVE-2015-4601 | 9.8 | May 16 | PHP before 5.6.7 might allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via an unexpected data type, related to "type… Affected: 7.0 |
| CVE-2015-4600 | 9.8 | May 16 | The SoapClient implementation in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (application crash) or… Affected: 7.0 |
| CVE-2015-4599 | 9.8 | May 16 | The SoapFault::__toString method in ext/soap/soap.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information,… Affected: 7.0 |
The 500 most important CVEs for this product (exploited first, then by severity)