Red Hat
Page 24 of 61 — Red Hat CVEs from a corpus of 6097, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-11038 | Medium | 5.3 | 2019-06-19 | When using the gdImageCreateFromXbm() function in the GD Graphics Library (aka LibGD) 2.2.5, as used in the PHP GD extension in PHP versions 7.1.x below 7.1.30… |
CVE-2012-6711 | High | 7.0 | 2019-06-18 | A heap-based buffer overflow exists in GNU Bash before 4.3 when wide characters, not supported by the current locale set in the LC_CTYPE environment variable… |
CVE-2019-8324 | High | 8.8 | 2019-06-17 | An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could in… |
CVE-2019-4239 | Medium | 5.5 | 2019-06-14 | IBM MQ Advanced Cloud Pak (IBM Cloud Private 1.0.0 through 3.0.1) stores user credentials in plain in clear text which can be read by a local user. IBM X-Force… |
CVE-2019-10159 | Medium | 4.3 | 2019-06-14 | cfme-gemset versions 5.10.4.3 and below, 5.9.9.3 and below are vulnerable to a data leak, due to an improper authorization in the migration log controller. An… |
CVE-2019-10126 | Critical | 9.8 | 2019-06-14 | A flaw was found in the Linux kernel. A heap based buffer overflow in mwifiex_uap_parse_tail_ies function in drivers/net/wireless/marvell/mwifiex/ie.c might le… |
CVE-2019-7845 | High | 8.8 | 2019-06-12 | Adobe Flash Player versions 32.0.0.192 and earlier, 32.0.0.192 and earlier, and 32.0.0.192 and earlier have an use after free vulnerability. Successful exploit… |
CVE-2019-3888 | Critical | 9.8 | 2019-06-12 | A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeR… |
CVE-2019-3875 | Medium | 6.5 | 2019-06-12 | A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL lis… |
CVE-2019-3873 | Medium | 6.4 | 2019-06-12 | It was found that Picketlink as shipped with Jboss Enterprise Application Platform 7.2 would accept an xinclude parameter in SAMLresponse XML. An attacker coul… |
CVE-2019-3872 | Medium | 5.4 | 2019-06-12 | It was found that a SAMLRequest containing a script could be processed by Picketlink versions shipped in Jboss Application Platform 7.2.x and 7.1.x. An attacke… |
CVE-2019-10157 | Medium | 4.7 | 2019-06-12 | It was found that Keycloak's Node.js adapter before version 4.8.3 did not properly verify the web token received from the server in its backchannel logout . An… |
CVE-2019-10155 | Low | 3.1 | 2019-06-12 | The Libreswan Project has found a vulnerability in the processing of IKEv1 informational exchange packets which are encrypted and integrity protected using the… |
CVE-2019-10150 | Medium | 5.9 | 2019-06-12 | It was found that OpenShift Container Platform versions 3.6.x - 4.6.0 does not perform SSH Host Key checking when using ssh key authentication during builds. A… |
CVE-2017-15123 | Medium | 5.3 | 2019-06-12 | A flaw was found in the CloudForms web interface, versions 5.8 - 5.10, where the RSS feed URLs are not properly restricted to authenticated users only. An atta… |
CVE-2019-0197 | Medium | 4.2 | 2019-06-11 | A vulnerability was found in Apache HTTP Server 2.4.34 to 2.4.38. When HTTP/2 was enabled for a http: host or H2Upgrade was enabled for h2 on a https: host, an… |
CVE-2019-10160 | Critical | 9.8 | 2019-06-07 | A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 affecting versions 2.7, 3.5, 3.6, 3.7 and… |
CVE-2019-9755 | High | 7.0 | 2019-06-05 | An integer underflow issue exists in ntfs-3g 2017.3.23. A local attacker could potentially exploit this by running /bin/ntfs-3g with specially crafted argument… |
CVE-2019-12614 | Medium | 4.1 | 2019-06-03 | An issue was discovered in dlpar_parse_cc_property in arch/powerpc/platforms/pseries/dlpar.c in the Linux kernel through 5.1.6. There is an unchecked kstrdup o… |
CVE-2019-11356 | Critical | 9.8 | 2019-06-03 | The CalDAV feature in httpd in Cyrus IMAP 2.5.x through 2.5.12 and 3.0.x through 3.0.9 allows remote attackers to execute arbitrary code via a crafted HTTP PUT… |
CVE-2019-3895 | High | 8.0 | 2019-06-03 | An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An attacker could cause… |
CVE-2019-3846 | High | 8.8 | 2019-06-03 | A flaw that allowed an attacker to corrupt memory and possibly escalate privileges was found in the mwifiex kernel module while connecting to a malicious wirel… |
CVE-2019-10147 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are not limited by cgroups du… |
CVE-2019-10145 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` do not have seccomp filtering… |
CVE-2019-10144 | High | 7.7 | 2019-06-03 | rkt through version 1.30.0 does not isolate processes in containers that are run with `rkt enter`. Processes run with `rkt enter` are given all capabilities du… |
CVE-2019-12450 | Critical | 9.8 | 2019-05-29 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progress. Instea… |
CVE-2019-10143 | High | 7.0 | 2019-05-24 | It was discovered freeradius up to and including version 3.0.19 does not correctly configure logrotate, allowing a local attacker who already has control of th… |
CVE-2019-5798 | Medium | 6.5 | 2019-05-23 | Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted… |
CVE-2019-0201 | Medium | 5.9 | 2019-05-23 | An issue is present in Apache ZooKeeper 1.0.0 to 3.4.13 and 3.5.0-alpha to 3.5.4-beta. ZooKeeper’s getACL() command doesn’t check any permission when retrieves… |
CVE-2019-7837 | High | 8.8 | 2019-05-22 | Adobe Flash Player versions 32.0.0.171 and earlier, 32.0.0.171 and earlier, and 32.0.0.171 and earlier have a use after free vulnerability. Successful exploita… |
CVE-2019-10132 | High | 8.8 | 2019-05-22 | A vulnerability was found in libvirt >= 4.1.0 in the virtlockd-admin.socket and virtlogd-admin.socket systemd units. A missing SocketMode configuration paramet… |
CVE-2019-3839 | High | 7.8 | 2019-05-16 | It was found that in ghostscript some privileged operators remained accessible from various places after the CVE-2019-6116 fix. A specially crafted PostScript… |
CVE-2019-0820 | High | 7.5 | 2019-05-16 | A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Servic… |
CVE-2016-7043 | Medium | 5.9 | 2019-05-15 | It has been reported that KIE server and Busitess Central before version 7.21.0.Final contain username and password as plaintext Java properties. Any app deplo… |
CVE-2019-11833 | Medium | 5.5 | 2019-05-15 | fs/ext4/extents.c in the Linux kernel through 5.1.2 does not zero out the unused memory region in the extent tree block, which might allow local users to obtai… |
CVE-2019-11884 | Low | 3.3 | 2019-05-10 | The do_hidp_sock_ioctl function in net/bluetooth/hidp/sock.c in the Linux kernel before 5.0.15 allows a local user to obtain potentially sensitive information… |
CVE-2019-11811 | High | 7.0 | 2019-05-07 | An issue was discovered in the Linux kernel before 5.0.4. There is a use-after-free upon attempted read access to /proc/ioports after the ipmi_si module is rem… |
CVE-2019-3894 | High | 8.8 | 2019-05-03 | It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run the thread as. These… |
CVE-2019-3805 | Medium | 4.7 | 2019-05-03 | A flaw was discovered in wildfly versions up to 16.0.0.Final that would allow local users who are able to execute init.d script to terminate arbitrary processe… |
CVE-2019-11036 | Critical | 9.1 | 2019-05-03 | When processing certain files, PHP EXIF extension in versions 7.1.x below 7.1.29, 7.2.x below 7.2.18 and 7.3.x below 7.3.5 can be caused to read past allocated… |
CVE-2019-10131 | High | 7.1 | 2019-04-30 | An off-by-one read vulnerability was discovered in ImageMagick before version 7.0.7-28 in the formatIPTCfromBuffer function in coders/meta.c. A local attacker… |
CVE-2019-9810 | High | 8.8 | 2019-04-26 | Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. This vulnerabili… |
CVE-2019-9792 | Critical | 9.8 | 2019-04-26 | The IonMonkey just-in-time (JIT) compiler can leak an internal JS_OPTIMIZED_OUT magic value to the running script during a bailout. This magic value can then b… |
CVE-2019-9791 | Critical | 9.8 | 2019-04-26 | The type inference system allows the compilation of functions that can cause type confusions between arbitrary objects when compiled through the IonMonkey just… |
CVE-2019-9788 | Critical | 9.8 | 2019-04-26 | Mozilla developers and community members reported memory safety bugs present in Firefox 65, Firefox ESR 60.5, and Thunderbird 60.5. Some of these bugs showed e… |
CVE-2019-9900 | High | 8.3 | 2019-04-25 | When parsing HTTP/1.x header values, Envoy 1.9.0 and before does not reject embedded zero characters (NUL, ASCII 0x0). This allows remote attackers crafting he… |
CVE-2019-3900 | High | 7.7 | 2019-04-25 | An infinite loop issue was found in the vhost_net kernel module in Linux Kernel up to and including v5.1-rc6, while handling incoming packets in handle_rx(). I… |
CVE-2019-3868 | Low | 3.8 | 2019-04-24 | Keycloak up to version 6.0.0 allows the end user token (access or id token JWT) to be used as the session cookie for browser sessions for OIDC. As a result an… |
CVE-2019-2698 | High | 8.1 | 2019-04-23 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to ex… |
CVE-2019-2697 | High | 8.1 | 2019-04-23 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: 2D). Supported versions that are affected are Java SE: 7u211 and 8u202. Difficult to ex… |
CVE-2019-2695 | Medium | 6.5 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2694 | Medium | 6.5 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2693 | Medium | 6.5 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2691 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Roles). Supported versions that are affected are 8.0.15 and prior… |
CVE-2019-2689 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2688 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2687 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2686 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2685 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2684 | Medium | 5.9 | 2019-04-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: RMI). Supported versions that are affected are Java SE: 7u211, 8u202… |
CVE-2019-2683 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 5.6.43 and prior, 5.7.25… |
CVE-2019-2681 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2644 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.15 and prior. Easily expl… |
CVE-2019-2636 | Medium | 4.4 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Group Replication Plugin). Supported versions that are affected are 8.0.15 a… |
CVE-2019-2635 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Eas… |
CVE-2019-2634 | Medium | 5.1 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Dif… |
CVE-2019-2631 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Information Schema). Supported versions that are affected are 8.0.15 and pri… |
CVE-2019-2630 | Medium | 4.4 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Dif… |
CVE-2019-2628 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 5.7.25 and prior and 8.0.15 and pr… |
CVE-2019-2627 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 5.6.43 and p… |
CVE-2019-2626 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 8.0.15 and prior. Easily expl… |
CVE-2019-2625 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2624 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitab… |
CVE-2019-2623 | Medium | 5.3 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Options). Supported versions that are affected are 8.0.15 and prior. Difficu… |
CVE-2019-2620 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and p… |
CVE-2019-2617 | Medium | 4.4 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 8.0.15 and prior. Dif… |
CVE-2019-2614 | Medium | 4.4 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Replication). Supported versions that are affected are 5.6.43 and prior, 5.7… |
CVE-2019-2607 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2606 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and p… |
CVE-2019-2602 | High | 7.5 | 2019-04-23 | Vulnerability in the Java SE, Java SE Embedded component of Oracle Java SE (subcomponent: Libraries). Supported versions that are affected are Java SE: 7u211… |
CVE-2019-2596 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2593 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitab… |
CVE-2019-2592 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: PS). Supported versions that are affected are 5.7.25 and prior and 8.0.15 an… |
CVE-2019-2589 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and p… |
CVE-2019-2587 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Partition). Supported versions that are affected are 8.0.15 and prior. Easil… |
CVE-2019-2585 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitab… |
CVE-2019-2584 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Security: Privileges). Supported versions that are affected are 8.0.15 and p… |
CVE-2019-2581 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.7.25 and prior and 8… |
CVE-2019-2580 | Medium | 4.9 | 2019-04-23 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: InnoDB). Supported versions that are affected are 8.0.15 and prior. Easily exploitab… |
CVE-2019-0223 | High | 7.4 | 2019-04-23 | While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings… |
CVE-2019-11459 | Medium | 5.5 | 2019-04-22 | The tiff_document_render() and tiff_document_get_thumbnail() functions in the TIFF document backend in GNOME Evince through 3.32.0 did not handle errors from T… |
CVE-2019-3902 | Medium | 5.1 | 2019-04-22 | A flaw was found in Mercurial before 4.9. It was possible to use symlinks and subrepositories to defeat Mercurial's path-checking logic and write files outside… |
CVE-2019-3899 | Critical | 9.8 | 2019-04-22 | It was found that default configuration of Heketi does not require any authentication potentially exposing the management interface to misuse. This isue only a… |
CVE-2019-11244 | Medium | 5.0 | 2019-04-22 | In Kubernetes v1.8.x-v1.14.x, schema info is cached by kubectl in the location specified by --cache-dir (defaulting to $HOME/.kube/http-cache), written with wo… |
CVE-2019-11235 | Critical | 9.8 | 2019-04-22 | FreeRADIUS before 3.0.19 mishandles the "each participant verifies that the received scalar is within a range, and that the received group element is a valid p… |
CVE-2019-11234 | Critical | 9.8 | 2019-04-22 | FreeRADIUS before 3.0.19 does not prevent use of reflection for authentication spoofing, aka a "Dragonblood" issue, a similar issue to CVE-2019-9497. |
CVE-2019-11358 | Medium | 6.1 | 2019-04-20 | jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an… |
CVE-2019-10245 | High | 7.5 | 2019-04-19 | In Eclipse OpenJ9 prior to the 0.14.0 release, the Java bytecode verifier incorrectly allows a method to execute past the end of bytecode array causing crashes… |
CVE-2018-16878 | Medium | 5.5 | 2019-04-18 | A flaw was found in pacemaker up to and including version 2.0.1. An insufficient verification inflicted preference of uncontrolled processes can lead to DoS |
CVE-2018-16877 | High | 7.8 | 2019-04-18 | A flaw was found in the way pacemaker's client-server authentication was implemented in versions up to and including 2.0.0. A local attacker could use this fla… |