SL
Product
SUSE Linux Enterprise Server
On CISA KEVExploited in the wild
129
CVEs
2
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 24High 48Medium 25Low 3
Watch
Add SUSE Linux Enterprise Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2010-3081 | 7.8 | Sep 24 | The compat_alloc_user_space functions in include/asm/compat.h files in the Linux kernel before 2.6.36-rc4-git2 on 64-bit platforms do not properly allocate the userspace memory… Affected: 11 |
| CVE-2010-2960 | 7.8 | Sep 8 | The keyctl_session_to_parent function in security/keys/keyctl.c in the Linux kernel 2.6.35.4 and earlier expects that a certain parent session keyring exists, which allows local… Affected: 11 |
| CVE-2010-2798 | 7.8 | Sep 8 | The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35 uses an incorrect size value in calculations associated with sentinel directory entries,… Affected: 11; 11 |
| CVE-2010-2524 | 7.8 | Sep 8 | The DNS resolution functionality in the CIFS implementation in the Linux kernel before 2.6.35, when CONFIG_CIFS_DFS_UPCALL is enabled, relies on a user's keyring for the… Affected: 11 |
| CVE-2009-3289 | 7.8 | Sep 22 | The g_file_copy function in glib 2.0 sets the permissions of a target file to the permissions of a symbolic link (777), which allows user-assisted local users to modify files of… Affected: 11 |
| CVE-2008-2812 | 7.8 | Jul 9 | The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via… Affected: 10; 10 |
| CVE-2018-12122 | 7.5 | Nov 28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Slowloris HTTP Denial of Service: An attacker can cause a Denial of Service (DoS) by sending headers… Affected: 12; 15 |
| CVE-2018-12116 | 7.5 | Nov 28 | Node.js: All versions prior to Node.js 6.15.0 and 8.14.0: HTTP request splitting: If Node.js can be convinced to use unsanitized user-provided Unicode data for the `path` option… Affected: 12; 15 |
| CVE-2018-19052 | 7.5 | Nov 7 | An issue was discovered in mod_alias_physical_handler in mod_alias.c in lighttpd before 1.4.50 Affected: 11; 11; 12; 12; 12; 12; +1 more |
| CVE-2015-3405 | 7.5 | Aug 9 | ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the… Affected: 11.0 |
| CVE-2015-5300 | 7.5 | Jul 21 | The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote… Affected: 12 |
| CVE-2014-9854 | 7.5 | Mar 17 | coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image." Affected: 12 |
| CVE-2016-5244 | 7.5 | Jun 27 | The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain… Affected: 12 |
| CVE-2014-3687 | 7.5 | Nov 10 | The sctp_assoc_lookup_asconf_ack function in net/sctp/associola.c in the SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of… Affected: 11 |
| CVE-2014-3673 | 7.5 | Nov 10 | The SCTP implementation in the Linux kernel through 3.17.2 allows remote attackers to cause a denial of service (system crash) via a malformed ASCONF chunk, related to… Affected: 10; 11; 11; 12 |
| CVE-2014-1505 | 7.5 | Mar 19 | The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain… Affected: 11; 11 |
| CVE-2014-1487 | 7.5 | Feb 6 | The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass… Affected: 11; 11 |
| CVE-2014-1481 | 7.5 | Feb 6 | Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window… Affected: 11; 11 |
| CVE-2014-1479 | 7.5 | Feb 6 | The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent… Affected: 11; 11 |
| CVE-2019-3688 | 7.1 | Oct 7 | The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and… Affected: 12; 12; 12; 15; 15 |
| CVE-2010-2537 | 7.1 | Sep 30 | The btrfs_ioctl_clone function in fs/btrfs/ioctl.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a (1) BTRFS_IOC_CLONE or (2)… Affected: 11 |
| CVE-2017-14798 | 7.0 | Mar 1 | A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root Affected: 11 |
| CVE-2009-3547 | 7.0 | Nov 4 | Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain… Affected: 10 |
| CVE-2020-6426 | 6.5 | Mar 23 | Inappropriate implementation in V8 in Google Chrome prior to 80.0.3987.149 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page Affected: 12 |
| CVE-2018-19208 | 6.5 | Nov 12 | In libwpd 0.10.2, there is a NULL pointer dereference in the function WP6ContentListener::defineTable in WP6ContentListener.cpp that will lead to a denial of service attack Affected: 11 |
| CVE-2014-1523 | 6.5 | Apr 30 | Heap-based buffer overflow in the read_u32 function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote… Affected: 10; 11 |
| CVE-2020-15707 | 6.4 | Jul 29 | Integer overflows were discovered in the functions grub_cmd_initrd and grub_initrd_init in the efilinux component of GRUB2, as shipped in Debian, Red Hat, and Ubuntu (the… Affected: 11; 12; 15 |
| CVE-2020-15706 | 6.4 | Jul 29 | GRUB2 contains a race condition in grub_script_function_create() leading to a use-after-free vulnerability which can be triggered by redefining a function whilst the same function… Affected: 11; 12; 15 |
| CVE-2020-15705 | 6.4 | Jul 29 | GRUB2 fails to validate kernel signature when booted directly without shim, allowing secure boot to be bypassed Affected: 11; 12; 15 |
| CVE-2014-1530 | 6.1 | Apr 30 | The docshell implementation in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to trigger the… Affected: 10; 11 |
| CVE-2016-0264 | 5.6 | May 24 | Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 FP40… Affected: 12 |
| CVE-2018-20105 | 5.5 | Jan 27 | A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they… Affected: 15 |
| CVE-2014-8559 | 5.5 | Nov 10 | The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of… Affected: 11 |
| CVE-2014-3647 | 5.5 | Nov 10 | arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 does not properly perform RIP changes, which allows guest OS users to cause a denial of service… Affected: 11 |
| CVE-2014-3646 | 5.5 | Nov 10 | arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2 does not have an exit handler for the INVVPID instruction, which allows guest OS users to cause a denial… Affected: 11 |
| CVE-2014-3610 | 5.5 | Nov 10 | The WRMSR processing functionality in the KVM subsystem in the Linux kernel through 3.17.2 does not properly handle the writing of a non-canonical address to a model-specific… Affected: 11 |
| CVE-2014-1496 | 5.5 | Mar 19 | Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 might allow local users to gain privileges by modifying the extracted… Affected: 11; 11 |
| CVE-2010-3078 | 5.5 | Sep 21 | The xfs_ioc_fsgetxattr function in fs/xfs/linux-2.6/xfs_ioctl.c in the Linux kernel before 2.6.36-rc4 does not initialize a certain structure member, which allows local users to… Affected: 11 |
| CVE-2010-2942 | 5.5 | Sep 21 | The actions implementation in the network queueing functionality in the Linux kernel before 2.6.36-rc2 does not properly initialize certain structure members when performing dump… Affected: 10; 11; 11 |
| CVE-2010-2066 | 5.5 | Sep 8 | The mext_check_arguments function in fs/ext4/move_extent.c in the Linux kernel before 2.6.35 allows local users to overwrite an append-only file via a MOVE_EXT ioctl call that… Affected: 11 |
| CVE-2009-3621 | 5.5 | Oct 22 | net/unix/af_unix.c in the Linux kernel 2.6.31.4 and earlier allows local users to cause a denial of service (system hang) by creating an abstract-namespace AF_UNIX listening… Affected: 10; 10 |
| CVE-2007-6716 | 5.5 | Sep 4 | fs/direct-io.c in the dio subsystem in the Linux kernel before 2.6.23 does not properly zero out the dio struct, which allows local users to cause a denial of service (OOPS), as… Affected: 10; 10 |
| CVE-2008-3275 | 5.5 | Aug 12 | The (1) real_lookup and (2) __lookup_hash functions in fs/namei.c in the vfs implementation in the Linux kernel before 2.6.25.15 do not prevent creation of a child dentry for a… Affected: 10 |
| CVE-2011-4190 | 5.3 | Jun 8 | The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20 Affected: 11; 11; 11.0 |
| CVE-2019-15624 | 4.9 | Feb 4 | Improper Input Validation in Nextcloud Server 15.0.7 allows group admins to create users with IDs of system folders Affected: 12 |
| CVE-2014-8086 | 4.7 | Oct 13 | Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a… Affected: 11 |
| CVE-2015-7976 | 4.3 | Jan 30 | The ntpq saveconfig command in NTP 4.1.2, 4.2.x before 4.2.8p6, 4.3, 4.3.25, 4.3.70, and 4.3.77 does not properly filter special characters, which allows attackers to cause… Affected: 12 |
| CVE-2015-4000 | 3.7 | May 21 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows… Affected: 12 |
| CVE-2018-6556 | 3.3 | Aug 10 | The lxc-user-nic component of LXC allows unprivileged users to open arbitrary files Affected: 11; 11 |
| CVE-2014-8134 | 3.3 | Dec 12 | The paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel through 3.18 uses an improper paravirt_enabled setting for KVM guest kernels, which makes it easier… Affected: 11 |