EL
Product
Enterprise Linux Server Aus
On CISA KEVExploited in the wildRansomware-linked
1,057
CVEs
37
On KEV
10.0
Max CVSS
0
New 30D
Severity mix
Critical 190High 307Medium 3Low 0
Watch
Add Enterprise Linux Server Aus to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-3137 | 7.5 | Jan 16 | A response packet can cause a resolver to terminate when processing an answer containing a CNAME or DNAME Affected: 6.2; 6.4; 6.5; 6.6; 7.2; 7.3; +2 more |
| CVE-2018-12121 | 7.5 | Nov 28 | Node.js: All versions prior to Node.js 6.15.0, 8.14.0, 10.14.0 and 11.3.0: Denial of Service with large HTTP headers: By using a combination of many requests with maximum sized… Affected: 8.2; 8.4; 8.6 |
| CVE-2018-5391 | 7.5 | Sep 6 | The Linux kernel, versions 3.9+, is vulnerable to a denial of service attack with low rates of specially modified packets targeting IP fragment re-assembly Affected: 6.4; 6.5; 6.6; 7.2; 7.3; 7.4 |
| CVE-2018-14624 | 7.5 | Sep 6 | A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16 Affected: 7.6 |
| CVE-2018-14622 | 7.5 | Aug 30 | A null-pointer dereference vulnerability was found in libtirpc before version 0.3.3-rc3 Affected: 7.4 |
| CVE-2018-5390 | 7.5 | Aug 6 | Linux kernel versions 4.9+ can be forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service Affected: 6.4; 6.5; 6.6; 7.2; 7.3; 7.4 |
| CVE-2016-9578 | 7.5 | Jul 27 | A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling Affected: 7.3; 7.4 |
| CVE-2017-2634 | 7.5 | Jul 27 | It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_rebuild_header() function for both IPv4… Affected: 5.6; 5.9 |
| CVE-2018-5184 | 7.5 | Jun 11 | Using remote content in encrypted messages can lead to the disclosure of plaintext Affected: 7.6 |
| CVE-2018-5162 | 7.5 | Jun 11 | Plaintext of decrypted emails can leak through the src attribute of remote images, or links Affected: 7.6 |
| CVE-2018-5157 | 7.5 | Jun 11 | Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer Affected: 7.6 |
| CVE-2017-7843 | 7.5 | Jun 11 | When Private Browsing mode is used, it is possible for a web worker to write persistent data to IndexedDB and fingerprint a user uniquely Affected: 7.4 |
| CVE-2017-7803 | 7.5 | Jun 11 | When a page's content security policy (CSP) header contains a "sandbox" directive, other directives are ignored Affected: 7.4 |
| CVE-2017-7787 | 7.5 | Jun 11 | Same-origin policy protections can be bypassed on pages with embedded iframes during page reloads, allowing the iframes to access content on the top level page, leading to… Affected: 7.3; 7.4 |
| CVE-2017-7754 | 7.5 | Jun 11 | An out-of-bounds read in WebGL with a maliciously crafted "ImageInfo" object during WebGL operations Affected: 7.3; 7.4 |
| CVE-2017-5455 | 7.5 | Jun 11 | The internal feed reader APIs that crossed the sandbox barrier allowed for a sandbox escape and escalation of privilege if combined with another vulnerability that resulted in… Affected: 7.3; 7.4 |
| CVE-2017-5454 | 7.5 | Jun 11 | A mechanism to bypass file system access protections in the sandbox to use the file picker to access different files than those selected in the file picker through the use of… Affected: 7.3; 7.4 |
| CVE-2017-5449 | 7.5 | Jun 11 | A possibly exploitable crash triggered during layout and manipulation of bidirectional unicode text in concert with CSS animations Affected: 7.3; 7.4 |
| CVE-2017-5445 | 7.5 | Jun 11 | A vulnerability while parsing "application/http-index-format" format content where uninitialized values are used to create an array Affected: 7.3; 7.4 |
| CVE-2017-5444 | 7.5 | Jun 11 | A buffer overflow vulnerability while parsing "application/http-index-format" format content when the header contains improperly formatted data Affected: 7.3; 7.4 |
| CVE-2017-5378 | 7.5 | Jun 11 | Hashed codes of JavaScript objects are shared between pages Affected: 7.3; 7.4 |
| CVE-2016-9902 | 7.5 | Jun 11 | The Pocket toolbar button, once activated, listens for events fired from it's own pages but does not verify the origin of incoming events Affected: 7.3; 7.4 |
| CVE-2016-9900 | 7.5 | Jun 11 | External resources that should be blocked when loaded by SVG images can bypass security restrictions through the use of "data:" URLs Affected: 7.3; 7.4 |
| CVE-2018-12020 | 7.5 | Jun 8 | mainproc.c in GnuPG before 2.2.8 mishandles the original filename during decryption and verification actions, which allows remote attackers to spoof the output that GnuPG sends on… Affected: 7.6 |
| CVE-2018-10393 | 7.5 | Apr 26 | bark_noise_hybridmp in psy.c in Xiph.Org libvorbis 1.3.6 has a stack-based buffer over-read Affected: 8.2; 8.4 |
| CVE-2018-5748 | 7.5 | Jan 25 | qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply Affected: 7.6 |
| CVE-2017-1000410 | 7.5 | Dec 7 | The Linux kernel version 3.3-rc1 and later is affected by a vulnerability lies in the processing of incoming L2CAP commands - ConfigRequest, and ConfigResponse messages Affected: 7.6 |
| CVE-2016-8610 | 7.5 | Nov 13 | A denial of service flaw was found in OpenSSL 0.9.8, 1.0.1, 1.0.2 through 1.0.2h, and 1.1.0 in the way the TLS/SSL protocol defined processing of ALERT packets during a connection… Affected: 7.3; 7.4; 7.6 |
| CVE-2017-10388 | 7.5 | Oct 19 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries) Affected: 7.4; 7.6; 7.7 |
| CVE-2017-1000115 | 7.5 | Oct 5 | Mercurial prior to version 4.3 is vulnerable to a missing symlink check that can malicious repositories to modify files outside the repository Affected: 7.4; 7.6 |
| CVE-2017-0901 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier fails to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem Affected: 7.4; 7.6 |
| CVE-2017-0900 | 7.5 | Aug 31 | RubyGems version 2.6.12 and earlier is vulnerable to maliciously crafted gem specifications to cause a denial of service attack against RubyGems clients who have issued a `query`… Affected: 7.4; 7.6 |
| CVE-2016-6796 | 7.5 | Aug 11 | A malicious web application running on Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 was able to bypass a configured… Affected: 7.4; 7.6; 7.7 |
| CVE-2016-6797 | 7.5 | Aug 10 | The ResourceLinkFactory implementation in Apache Tomcat 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not limit web… Affected: 7.4; 7.6; 7.7 |
| CVE-2017-10115 | 7.5 | Aug 8 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: JCE) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-10067 | 7.5 | Aug 8 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Security) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2015-7704 | 7.5 | Aug 7 | The ntpd client in NTP 4.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service via a number of crafted "KOD" messages Affected: 6.5; 6.6; 7.3; 7.4; 7.6; 7.7 |
| CVE-2015-7701 | 7.5 | Aug 7 | Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2015-7692 | 7.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2015-7691 | 7.5 | Aug 7 | The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing… Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-10664 | 7.5 | Aug 2 | qemu-nbd in QEMU (aka Quick Emulator) does not ignore SIGPIPE, which allows remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client… Affected: 7.4; 7.6; 7.7 |
| CVE-2016-8743 | 7.5 | Jul 27 | Apache HTTP Server, in all releases prior to 2.2.32 and 2.4.25, was liberal in the whitespace accepted from requests and sent in response lines and headers Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2015-7703 | 7.5 | Jul 24 | The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers… Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-10978 | 7.5 | Jul 17 | An FR-GV-201 issue in FreeRADIUS 2.x before 2.2.10 and 3.x before 3.0.15 allows "Read / write overflow in make_secret()" and a denial of service Affected: 7.4; 7.6; 7.7 |
| CVE-2017-7668 | 7.5 | Jun 20 | The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input… Affected: 7.2; 7.3; 7.4; 7.6; 7.7 |
| CVE-2017-3302 | 7.5 | Feb 12 | Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and 10.2.x through… Affected: 7.4; 7.6 |
| CVE-2017-5848 | 7.5 | Feb 9 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (invalid memory read and… Affected: 7.4; 7.6; 7.7 |
| CVE-2016-9446 | 7.5 | Jan 23 | The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumbnailing a simple 1… Affected: 7.4; 7.6; 7.7 |
| CVE-2016-7426 | 7.5 | Jan 13 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers to cause a denial… Affected: 7.3; 7.4; 7.6; 7.7 |
| CVE-2016-9131 | 7.5 | Jan 12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon… Affected: 7.2; 7.3; 7.4; 7.6; 7.7 |
The 500 most important CVEs for this product (exploited first, then by severity)