EL
Product
Enterprise Linux Eus
On CISA KEVExploited in the wildRansomware-linked
789
CVEs
42
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 73High 196Medium 231Low 0
Watch
Add Enterprise Linux Eus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-10115 | 7.5 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-10067 | 7.5 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security) Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-10664 | 7.5 | Aug 2 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-8743 | 7.5 | Jul 27 | Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-7668 | 7.5 | Jun 20 | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-5848 | 7.5 | Feb 9 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-9446 | 7.5 | Jan 23 | The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1… Affected: 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-9131 | 7.5 | Jan 12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2016-8864 | 7.5 | Nov 2 | named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon… Affected: 6.7; 7.2; 7.3; 7.4; 7.5; 7.6; +1 more |
| CVE-2016-3627 | 7.5 | May 17 | The xmlStringGetNodeList function in tree.c in libxml2 2.9.3 and earlier, when used in recovery mode, allows context-dependent attackers to cause a denial of service (infinite… Affected: 7.2; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2015-3276 | 7.5 | Dec 7 | The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than… Affected: 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2014-1505 | 7.5 | Mar 19 | The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain… Affected: 6.5 |
| CVE-2014-1487 | 7.5 | Feb 6 | The Web workers implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1481 | 7.5 | Feb 6 | Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 allow remote attackers to bypass intended restrictions on window… Affected: 6.5 |
| CVE-2014-1479 | 7.5 | Feb 6 | The System Only Wrapper (SOW) implementation in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent… Affected: 6.5 |
| CVE-2012-0207 | 7.5 | May 17 | The igmp_heard_query function in net/ipv4/igmp.c in the Linux kernel before 3.2.1 allows remote attackers to cause a denial of service (divide-by-zero error and panic) via IGMP… Affected: 5.6 |
| CVE-2010-0302 | 7.5 | Mar 5 | Use-after-free vulnerability in the abstract file-descriptor handling interface in the cupsdDoSelect function in scheduler/select.c in the scheduler in cupsd in CUPS before 1.4.4,… Affected: 5.4 |
| CVE-2009-4272 | 7.5 | Jan 27 | A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via… Affected: 5.4 |
| CVE-2009-1837 | 7.5 | Jun 12 | Race condition in the NPObjWrapper_NewResolve function in modules/plugin/base/src/nsJSNPRuntime.cpp in xul.dll in Mozilla Firefox 3 before 3.0.11 might allow remote attackers to… Affected: 4.8; 5.3 |
| CVE-2006-5158 | 7.5 | Oct 5 | The nlmclnt_mark_reclaim in clntlock.c in NFS lockd in Linux kernel before 2.6.16 allows remote attackers to cause a denial of service (process crash) and deny access to NFS… Affected: 4.5 |
| CVE-2025-3155 | 7.4 | Apr 3 | Yelp: arbitrary file read Affected: 9.2; 9.4; 9.6 |
| CVE-2019-14823 | 7.4 | Oct 14 | A flaw was found in the "Leaf and Chain" OCSP policy implementation in JSS' CryptoManager versions after 4.4.6, 4.5.3, 4.6.0, where it implicitly trusted the root certificate of a… Affected: 7.7 |
| CVE-2019-0223 | 7.4 | Apr 23 | While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a… Affected: 6.7; 7.2; 7.3; 7.4; 7.5; 7.6 |
| CVE-2026-58379 | 7.3 | Jul 3 | Gimp: gimp: heap buffer overflow in read_channel_data() Affected: 9.6 |
| CVE-2025-62230 | 7.3 | Oct 30 | Xorg: xwayland: use-after-free in xkb client resource removal Affected: 8.4; 9.4 |
| CVE-2025-62231 | 7.3 | Oct 30 | Xorg: xmayland: value overflow in xkbsetcompatmap() Affected: 8.4; 9.4 |
| CVE-2024-1488 | 7.3 | Feb 15 | A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration Affected: 8.6; 8.8; 9.2; 9.4 |
| CVE-2019-10086 | 7.3 | Aug 20 | In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property… Affected: 7.7 |
| CVE-2020-25719 | 7.2 | Feb 18 | A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication Affected: 8.2; 8.4 |
| CVE-2019-10193 | 7.2 | Jul 11 | A stack-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 8.1; 8.2; 8.4 |
| CVE-2019-10192 | 7.2 | Jul 11 | A heap-buffer overflow vulnerability was found in the Redis hyperloglog data structure versions 3.x before 3.2.13, 4.x before 4.0.14 and 5.x before 5.0.4 Affected: 8.1; 8.2; 8.4 |
| CVE-2023-3758 | 7.1 | Apr 18 | A race condition flaw was found in sssd where the GPO policy is not consistently applied for authenticated users Affected: 8.6; 8.8; 9.0; 9.2; 9.4; 9.6 |
| CVE-2023-6606 | 7.1 | Dec 8 | Kernel: out-of-bounds read vulnerability in smbcalcsize Affected: 9.2; 9.4 |
| CVE-2019-2800 | 7.1 | Jul 23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication) Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2019-2534 | 7.1 | Jan 16 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication) Affected: 8.1; 8.2; 8.4; 8.6 |
| CVE-2018-2562 | 7.1 | Jan 18 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server : Partition) Affected: 7.5; 7.6; 7.7 |
| CVE-2017-12613 | 7.1 | Oct 24 | When apr_time_exp*() or apr_os_exp_time*() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be… Affected: 6.7; 7.3; 7.4; 7.5; 7.6; 7.7 |
| CVE-2017-10309 | 7.1 | Oct 19 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Deployment) Affected: 7.5 |
| CVE-2009-3939 | 7.1 | Nov 16 | The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and earlier has world-writable permissions, which allows local users to change the I/O mode of the… Affected: 5.4 |
| CVE-2023-1476 | 7.0 | Nov 3 | A use-after-free flaw was found in the Linux kernel’s mm/mremap memory address space accounting source code Affected: 8.8 |
| CVE-2021-3697 | 7.0 | Jul 6 | A crafted JPEG image may lead the JPEG reader to underflow its data pointer, allowing user-controlled data to be written in heap Affected: 8.2; 8.4; 8.6; 9.0 |
| CVE-2021-3609 | 7.0 | Mar 3 | .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or… Affected: 8.1; 8.2; 8.4 |
| CVE-2019-12817 | 7.0 | Jun 25 | arch/powerpc/mm/mmu_context_book3s64.c in the Linux kernel before 5.1.15 for powerpc has a bug where unrelated processes may be able to read/write to one another's virtual memory… Affected: 8.1; 8.2; 8.4 |
| CVE-2019-9755 | 7.0 | Jun 5 | An integer underflow issue exists in ntfs-3g 2017.3.23 Affected: 8.1; 8.2; 8.4 |
| CVE-2018-14633 | 7.0 | Sep 25 | A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is… Affected: 7.4; 7.6 |
| CVE-2009-3547 | 7.0 | Nov 4 | Multiple race conditions in fs/pipe.c in the Linux kernel before 2.6.32-rc6 allow local users to cause a denial of service (NULL pointer dereference and system crash) or gain… Affected: 4.8; 5.4 |
The 500 most important CVEs for this product (exploited first, then by severity)