Red Hat
Page 53 of 74 — Red Hat CVEs from a corpus of 7350, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-4970 | High | 7.5 | 2017-04-13 | handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite l… |
CVE-2016-2104 | Medium | 6.1 | 2017-04-13 | Multiple cross-site scripting (XSS) vulnerabilities in Red Hat Satellite 5 allow remote attackers to inject arbitrary web script or HTML via (1) the label para… |
CVE-2016-6348 | Medium | 6.1 | 2017-04-12 | JacksonJsonpInterceptor in RESTEasy might allow remote attackers to conduct a cross-site script inclusion (XSSI) attack. |
CVE-2016-4459 | High | 7.5 | 2017-04-12 | Stack-based buffer overflow in native/mod_manager/node.c in mod_cluster 1.2.9. |
CVE-2016-4989 | High | 7.0 | 2017-04-11 | setroubleshoot allows local users to bypass an intended container protection mechanism and execute arbitrary commands by (1) triggering an SELinux denial with… |
CVE-2016-4446 | High | 7.0 | 2017-04-11 | The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filenam… |
CVE-2016-4445 | High | 7.0 | 2017-04-11 | The fix_lookup_id function in sealert in setroubleshoot before 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial… |
CVE-2016-4444 | High | 7.0 | 2017-04-11 | The allow_execmod plugin for setroubleshoot before 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a craft… |
CVE-2016-1908 | Critical | 9.8 | 2017-04-11 | The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisio… |
CVE-2016-5011 | Medium | 4.6 | 2017-04-11 | The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (m… |
CVE-2016-8735 | Critical | 9.8 | 2017-04-06 | Remote code execution is possible with Apache Tomcat before 6.0.48, 7.x before 7.0.73, 8.x before 8.0.39, 8.5.x before 8.5.7, and 9.x before 9.0.0.M12 if JmxRe… |
CVE-2014-5009 | Critical | 9.8 | 2017-03-31 | Snoopy allows remote attackers to execute arbitrary commands. NOTE: this vulnerability exists due to an incomplete fix for CVE-2014-5008. |
CVE-2014-5008 | Critical | 9.8 | 2017-03-31 | Snoopy allows remote attackers to execute arbitrary commands. |
CVE-2008-7313 | Critical | 9.8 | 2017-03-31 | The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-479… |
CVE-2017-5973 | Medium | 5.5 | 2017-03-27 | The xhci_kick_epctx function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite lo… |
CVE-2016-7797 | High | 7.5 | 2017-03-24 | Pacemaker before 1.1.15, when using pacemaker remote, might allow remote attackers to cause a denial of service (node disconnection) via an unauthenticated con… |
CVE-2015-8896 | Medium | 6.5 | 2017-03-15 | Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted… |
CVE-2016-7103 | Medium | 6.1 | 2017-03-15 | Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText param… |
CVE-2017-5929 | Critical | 9.8 | 2017-03-13 | QOS.ch Logback before 1.2.0 has a serialization vulnerability affecting the SocketServer and ServerSocketReceiver components. |
CVE-2015-2877 | Low | 3.3 | 2017-03-03 | Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat… |
CVE-2017-6011 | Medium | 5.5 | 2017-02-16 | An issue was discovered in icoutils 0.31.1. An out-of-bounds read leading to a buffer overflow was observed in the "simple_vec" function in the "extract.c" sou… |
CVE-2017-6010 | Medium | 5.5 | 2017-02-16 | An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "extract_icons" function in the "extract.c" source file. This issue can be tr… |
CVE-2017-6009 | Medium | 5.5 | 2017-02-16 | An issue was discovered in icoutils 0.31.1. A buffer overflow was observed in the "decode_ne_resource_id" function in the "restable.c" source file. This is hap… |
CVE-2016-9560 | High | 7.8 | 2017-02-15 | Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a… |
CVE-2016-3616 | High | 8.8 | 2017-02-13 | The cjpeg utility in libjpeg allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) or execute arbitrary code vi… |
CVE-2016-2568 | High | 7.8 | 2017-02-13 | pkexec, when used with --user nonpriv, allows local users to escape to the parent session via a crafted TIOCSTI ioctl call, which pushes characters to the term… |
CVE-2017-3302 | High | 7.5 | 2017-02-12 | Crash in libmysqlclient.so in Oracle MySQL before 5.6.21 and 5.7.x before 5.7.5 and MariaDB through 5.5.54, 10.0.x through 10.0.29, 10.1.x through 10.1.21, and… |
CVE-2017-5848 | High | 7.5 | 2017-02-09 | The gst_ps_demux_parse_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denial of service (inval… |
CVE-2016-10165 | High | 7.1 | 2017-02-03 | The Type_MLU_Read function in cmstypes.c in Little CMS (aka lcms2) allows remote attackers to obtain sensitive information or cause a denial of service via an… |
CVE-2016-2518 | Medium | 5.3 | 2017-01-30 | The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer reque… |
CVE-2017-5205 | Critical | 9.8 | 2017-01-28 | The ISAKMP parser in tcpdump before 4.9.0 has a buffer overflow in print-isakmp.c:ikev2_e_print(). |
CVE-2017-5204 | Critical | 9.8 | 2017-01-28 | The IPv6 parser in tcpdump before 4.9.0 has a buffer overflow in print-ip6.c:ip6_print(). |
CVE-2017-5203 | Critical | 9.8 | 2017-01-28 | The BOOTP parser in tcpdump before 4.9.0 has a buffer overflow in print-bootp.c:bootp_print(). |
CVE-2017-5202 | Critical | 9.8 | 2017-01-28 | The ISO CLNS parser in tcpdump before 4.9.0 has a buffer overflow in print-isoclns.c:clnp_print(). |
CVE-2017-3318 | Medium | 4.0 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Error Handling). Supported versions that are affected are 5.5.53 and earlier… |
CVE-2017-3317 | Medium | 4.0 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Logging). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 and ea… |
CVE-2017-3313 | Medium | 4.7 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: MyISAM). Supported versions that are affected are 5.5.53 and earlier, 5.6.34… |
CVE-2017-3291 | Medium | 6.3 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6… |
CVE-2017-3265 | Medium | 5.6 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Packaging). Supported versions that are affected are 5.5.53 and earlier, 5.6… |
CVE-2017-3258 | Medium | 6.5 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DDL). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 an… |
CVE-2017-3244 | Medium | 6.5 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: DML). Supported versions that are affected are 5.5.53 and earlier, 5.6.34 an… |
CVE-2017-3243 | Medium | 4.4 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Charsets). Supported versions that are affected are 5.5.53 and earlier. Diff… |
CVE-2017-3238 | Medium | 6.5 | 2017-01-27 | Vulnerability in the MySQL Server component of Oracle MySQL (subcomponent: Server: Optimizer). Supported versions that are affected are 5.5.53 and earlier, 5.6… |
CVE-2016-9636 | Critical | 9.8 | 2017-01-27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers t… |
CVE-2016-9635 | Critical | 9.8 | 2017-01-27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers t… |
CVE-2016-9634 | Critical | 9.8 | 2017-01-27 | Heap-based buffer overflow in the flx_decode_delta_fli function in gst/flx/gstflxdec.c in the FLIC decoder in GStreamer before 1.10.2 allows remote attackers t… |
CVE-2016-5824 | Medium | 5.5 | 2017-01-27 | libical 1.0 allows remote attackers to cause a denial of service (use-after-free) via a crafted ics file. |
CVE-2016-9446 | High | 7.5 | 2017-01-23 | The vmnc decoder in the gstreamer does not initialize the render canvas, which allows remote attackers to obtain sensitive information as demonstrated by thumb… |
CVE-2016-9401 | Medium | 5.5 | 2017-01-23 | popd in bash might allow local users to bypass the restricted shell and cause a use-after-free via a crafted address. |
CVE-2016-7545 | High | 8.8 | 2017-01-19 | SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. |
CVE-2016-5198 | High | 8.8 | 2017-01-19 | V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumpt… |
CVE-2016-9811 | Medium | 4.7 | 2017-01-13 | The windows_icon_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G_SLICE is set to always-malloc, allows remote attackers to cause a den… |
CVE-2016-7426 | High | 7.5 | 2017-01-13 | NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allows remote attackers… |
CVE-2016-9131 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion fai… |
CVE-2016-9921 | Medium | 6.5 | 2016-12-23 | Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. It could occur while copying VGA data when… |
CVE-2016-9911 | Medium | 6.5 | 2016-12-23 | Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. It could occur while processing packet data in 'ehci_i… |
CVE-2016-9907 | Medium | 6.5 | 2016-12-23 | Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. It could occur while destroying the USB redirecto… |
CVE-2016-9675 | High | 7.8 | 2016-12-22 | openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially… |
CVE-2016-7091 | Medium | 4.4 | 2016-12-22 | sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC… |
CVE-2014-8241 | Critical | 9.8 | 2016-12-14 | XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a s… |
CVE-2016-4443 | Medium | 5.5 | 2016-12-14 | Red Hat Enterprise Virtualization (RHEV) Manager 3.6 allows local users to obtain encryption keys, certificates, and other sensitive information by reading the… |
CVE-2016-7466 | Medium | 6.0 | 2016-12-10 | Memory leak in the usb_xhci_exit function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator), when the xhci uses msix, allows local guest OS administrators to c… |
CVE-2016-7422 | Medium | 6.0 | 2016-12-10 | The virtqueue_map_desc function in hw/virtio/virtio.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (NULL poin… |
CVE-2016-6888 | Medium | 4.4 | 2016-12-10 | Integer overflow in the net_tx_pkt_init function in hw/net/net_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of… |
CVE-2016-6835 | Medium | 6.0 | 2016-12-10 | The vmxnet_tx_pkt_parse_headers function in hw/net/vmxnet_tx_pkt.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of servi… |
CVE-2016-5195 | High | 7.0 | 2016-11-10 | Race condition in mm/gup.c in the Linux kernel 2.x through 4.x before 4.8.3 allows local users to gain privileges by leveraging incorrect handling of a copy-on… |
CVE-2016-7865 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could le… |
CVE-2016-7864 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could le… |
CVE-2016-7863 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could le… |
CVE-2016-7862 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could le… |
CVE-2016-7861 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could le… |
CVE-2016-7860 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable type confusion vulnerability. Successful exploitation could le… |
CVE-2016-7859 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could le… |
CVE-2016-7858 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could le… |
CVE-2016-7857 | High | 8.8 | 2016-11-08 | Adobe Flash Player versions 23.0.0.205 and earlier, 11.2.202.643 and earlier have an exploitable use-after-free vulnerability. Successful exploitation could le… |
CVE-2016-8910 | Medium | 6.0 | 2016-11-04 | The rtl8139_cplus_transmit function in hw/net/rtl8139.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinit… |
CVE-2016-8909 | Medium | 6.0 | 2016-11-04 | The intel_hda_xfer function in hw/audio/intel-hda.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite lo… |
CVE-2016-8669 | Medium | 6.0 | 2016-11-04 | The serial_update_parameters function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (divid… |
CVE-2016-8576 | Medium | 6.0 | 2016-11-04 | The xhci_ring_fetch function in hw/usb/hcd-xhci.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (infinite loop… |
CVE-2016-8864 | High | 7.5 | 2016-11-02 | named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion fai… |
CVE-2016-7855 | High | 8.8 | 2016-11-01 | Use-after-free vulnerability in Adobe Flash Player before 23.0.0.205 on Windows and OS X and before 11.2.202.643 on Linux allows remote attackers to execute ar… |
CVE-2016-5629 | Medium | 4.9 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote administrators to affect availability vi… |
CVE-2016-5626 | Medium | 6.5 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availabili… |
CVE-2016-5624 | Medium | 6.5 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier allows remote authenticated users to affect availability via vectors related to DML. |
CVE-2016-5612 | Medium | 6.5 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.5.50 and earlier, 5.6.31 and earlier, and 5.7.13 and earlier allows remote authenticated users to affect availabili… |
CVE-2016-3492 | Medium | 6.5 | 2016-10-25 | Unspecified vulnerability in Oracle MySQL 5.5.51 and earlier, 5.6.32 and earlier, and 5.7.14 and earlier allows remote authenticated users to affect availabili… |
CVE-2016-1000033 | Low | 3.7 | 2016-10-25 | Shotwell version 0.22.0 (and possibly other versions) is vulnerable to a TLS/SSL certification validation flaw resulting in a potential for man in the middle a… |
CVE-2016-4286 | High | 8.8 | 2016-10-13 | Adobe Flash Player before 18.0.0.382 and 19.x through 23.x before 23.0.0.185 on Windows and OS X and before 11.2.202.637 on Linux allows attackers to bypass in… |
CVE-2016-7796 | Medium | 5.5 | 2016-10-13 | The manager_dispatch_notify_fd function in systemd allows local users to cause a denial of service (system hang) via a zero-length message received over a noti… |
CVE-2016-7065 | High | 8.8 | 2016-10-13 | The JMX servlet in Red Hat JBoss Enterprise Application Platform (EAP) 4 and 5 allows remote authenticated users to cause a denial of service and possibly exec… |
CVE-2016-6325 | High | 7.8 | 2016-10-13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 5 through 7, JBoss Web Server 3.0, and JBoss EWS 2 uses weak permissions for (1) /etc/sysconfig/tomcat an… |
CVE-2016-5425 | High | 7.8 | 2016-10-13 | The Tomcat package on Red Hat Enterprise Linux (RHEL) 7, Fedora, CentOS, Oracle Linux, and possibly other Linux distributions uses weak permissions for /usr/li… |
CVE-2016-1000007 | Medium | 6.1 | 2016-10-07 | Pagure 2.2.1 XSS in raw file endpoint |
CVE-2016-7040 | High | 8.8 | 2016-10-07 | Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and the web-based UI, wh… |
CVE-2016-3699 | High | 7.4 | 2016-10-07 | The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to byp… |
CVE-2016-7046 | Medium | 5.9 | 2016-10-03 | Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers to cause a denial o… |
CVE-2016-7031 | High | 7.5 | 2016-10-03 | The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents via a URL. |
CVE-2016-5432 | Low | 3.3 | 2016-10-03 | The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database provisioning inform… |
CVE-2016-5398 | Medium | 5.4 | 2016-10-03 | Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated users to inject arbitra… |
CVE-2016-6330 | Critical | 9.8 | 2016-09-27 | The server in Red Hat JBoss Operations Network (JON), when SSL authentication is not configured for JON server / agent communication, allows remote attackers t… |