EL
Product
Enterprise Linux Server Aus
On CISA KEVExploited in the wildRansomware-linked
1,057
CVEs
37
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 190High 307Medium 3Low 0
Watch
Add Enterprise Linux Server Aus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2018-12359 | 8.8 | Oct 18 | A buffer overflow can occur when rendering canvas content while adjusting the height and width of the canvas element dynamically, causing data to be written outside of the… Affected: 7.6 |
| CVE-2018-1000805 | 8.8 | Oct 8 | Paramiko version 2.4.1, 2.3.2, 2.2.3, 2.1.5, 2.0.8, 1.18.5, 1.17.6 contains a Incorrect Access Control vulnerability in SSH server that can result in RCE Affected: 6.4; 6.5; 6.6; 7.6 |
| CVE-2018-10873 | 8.8 | Aug 17 | A vulnerability was discovered in SPICE before version 0.14.1 where the generated code used for demarshalling messages lacked sufficient bounds checks Affected: 7.6 |
| CVE-2016-9577 | 8.8 | Jul 27 | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling Affected: 7.3; 7.4 |
| CVE-2017-12173 | 8.8 | Jul 27 | It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and was vulnerable to injection Affected: 7.4 |
| CVE-2018-5158 | 8.8 | Jun 11 | The PDF viewer does not sufficiently sanitize PostScript calculator functions, allowing malicious JavaScript to be injected through a crafted PDF file Affected: 7.6 |
| CVE-2018-5146 | 8.8 | Jun 11 | An out of bounds memory write while processing Vorbis audio data was reported through the Pwn2Own contest Affected: 7.4; 7.6 |
| CVE-2018-5130 | 8.8 | Jun 11 | When packets with a mismatched RTP payload type are sent in WebRTC connections, in some circumstances a potentially exploitable crash is triggered Affected: 7.4 |
| CVE-2018-5127 | 8.8 | Jun 11 | A buffer overflow can occur when manipulating the SVG "animatedPathSegList" through script Affected: 7.4 |
| CVE-2017-7846 | 8.8 | Jun 11 | It is possible to execute JavaScript in the parsed RSS feed when RSS feed is viewed as a website, e.g Affected: 7.4 |
| CVE-2017-7798 | 8.8 | Jun 11 | The Developer Tools feature suffers from a XUL injection vulnerability due to improper sanitization of the web page source code Affected: 7.3; 7.4 |
| CVE-2017-7752 | 8.8 | Jun 11 | A use-after-free vulnerability during specific user interactions with the input method editor (IME) in some languages due to how events are handled Affected: 7.3; 7.4 |
| CVE-2017-5436 | 8.8 | Jun 11 | An out-of-bounds write in the Graphite 2 library triggered with a maliciously crafted Graphite font Affected: 7.3; 7.4 |
| CVE-2018-10392 | 8.8 | Apr 26 | mapping0_forward in mapping0.c in Xiph.Org libvorbis 1.3.6 does not validate the number of channels, which allows remote attackers to cause a denial of service (heap-based buffer… Affected: 8.2; 8.4 |
| CVE-2014-8129 | 8.8 | Mar 12 | LibTIFF 4.0.3 allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted TIFF image, as demonstrated by… Affected: 7.2; 7.3; 7.4 |
| CVE-2018-7550 | 8.8 | Mar 1 | The load_multiboot function in hw/i386/multiboot.c in Quick Emulator (aka QEMU) allows local guest OS users to execute arbitrary code on the QEMU host via a mh_load_end_addr value… Affected: 7.6; 7.7 |
| CVE-2018-6560 | 8.8 | Feb 2 | In dbus-proxy/flatpak-proxy.c in Flatpak before 0.8.9, and 0.9.x and 0.10.x before 0.10.3, crafted D-Bus messages to the host can be used to break out of the sandbox, because… Affected: 7.6 |
| CVE-2017-17405 | 8.8 | Dec 15 | Ruby before 2.4.3 allows Net::FTP command injection Affected: 7.4; 7.6 |
| CVE-2017-5208 | 8.8 | Aug 22 | Integer overflow in the wrestool program in icoutils before 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, which… Affected: 7.3; 7.4; 7.6 |
| CVE-2017-9462 | 8.8 | Jun 6 | In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbitrary code, by using --debugger as a… Affected: 7.3; 7.4; 7.6 |
| CVE-2016-2818 | 8.8 | Jun 13 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to cause a denial of service… Affected: 7.2 |
| CVE-2016-3710 | 8.8 | May 11 | The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary code on the host by… Affected: 7.2; 7.3; 7.4; 7.6 |
| CVE-2016-3069 | 8.8 | Apr 13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository Affected: 7.2 |
| CVE-2016-3068 | 8.8 | Apr 13 | Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository Affected: 7.2 |
| CVE-2014-1531 | 8.8 | Apr 30 | Use-after-free vulnerability in the nsGenericHTMLElement::GetWidthHeightForImage function in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5,… Affected: 6.5 |
| CVE-2014-1529 | 8.8 | Apr 30 | The Web Notification API in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allows remote attackers to bypass… Affected: 6.5 |
| CVE-2014-1518 | 8.8 | Apr 30 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 29.0, Firefox ESR 24.x before 24.5, Thunderbird before 24.5, and SeaMonkey before 2.26 allow… Affected: 6.5 |
| CVE-2014-1513 | 8.8 | Mar 19 | TypedArrayObject.cpp in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 does not prevent a zero-length transition… Affected: 6.5 |
| CVE-2014-1509 | 8.8 | Mar 19 | Buffer overflow in the _cairo_truetype_index_to_ucs4 function in cairo, as used in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and… Affected: 6.5 |
| CVE-2014-1497 | 8.8 | Mar 19 | The mozilla::WaveReader::DecodeAudioData function in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote… Affected: 6.5 |
| CVE-2014-1482 | 8.8 | Feb 6 | RasterImage.cpp in Mozilla Firefox before 27.0, Firefox ESR 24.x before 24.3, Thunderbird before 24.3, and SeaMonkey before 2.24 does not prevent access to discarded data, which… Affected: 6.5 |
| CVE-2012-0247 | 8.8 | Jun 5 | ImageMagick 6.7.5-7 and earlier allows remote attackers to cause a denial of service (memory corruption) and possibly execute arbitrary code via crafted offset and count values in… Affected: 6.2 |
| CVE-2011-3045 | 8.8 | Mar 22 | Integer signedness error in the png_inflate function in pngrutil.c in libpng before 1.4.10beta01, as used in Google Chrome before 17.0.963.83 and other products, allows remote… Affected: 6.2 |
| CVE-2022-2601 | 8.6 | Dec 14 | A buffer overflow was found in grub_font_construct_glyph() Affected: 8.2 |
| CVE-2014-0144 | 8.6 | Sep 29 | QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer overflows or crash caused… Affected: 6.5 |
| CVE-2018-18284 | 8.6 | Oct 19 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving the 1Policy operator Affected: 7.6 |
| CVE-2018-17961 | 8.6 | Oct 15 | Artifex Ghostscript 9.25 and earlier allows attackers to bypass a sandbox protection mechanism via vectors involving errorhandler setup Affected: 7.6 |
| CVE-2018-5129 | 8.6 | Jun 11 | A lack of parameter validation on IPC messages results in a potential out-of-bounds write through malformed IPC messages Affected: 7.4 |
| CVE-2017-5448 | 8.6 | Jun 11 | An out-of-bounds write in "ClearKeyDecryptor" while decrypting some Clearkey-encrypted media content Affected: 7.3; 7.4 |
| CVE-2015-1779 | 8.6 | Jan 12 | The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers… Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2016-2857 | 8.4 | Apr 12 | The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length… Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2018-3169 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.6 |
| CVE-2018-3149 | 8.3 | Oct 17 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.6 |
| CVE-2018-2814 | 8.3 | Apr 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.6 |
| CVE-2018-2633 | 8.3 | Jan 18 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JNDI) Affected: 7.4; 7.6 |
| CVE-2017-10116 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Security) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-10074 | 8.3 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Hotspot) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2021-20233 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.2; 7.3; 7.4; 7.6; 7.7; 8.2 |
| CVE-2020-25632 | 8.2 | Mar 3 | A flaw was found in grub2 in versions prior to 2.06 Affected: 7.2; 7.3; 7.4; 7.6; 7.7; 8.2 |
| CVE-2019-8308 | 8.2 | Feb 12 | Flatpak before 1.0.7, and 1.1.x and 1.2.x before 1.2.3, exposes /proc in the apply_extra script sandbox, which allows attackers to modify a host-side executable file Affected: 7.6 |
The 500 most important CVEs for this product (exploited first, then by severity)