Linux (Oracle) - vulnerabilities (CVEs)

228 CVEs, 0 in the last 30 days, 63 known versions, newest CVE from 2026-05-01. Vendor: Oracle.

CVEs of Linux

CVE-2026-35233 - CVSS 4.4 (medium), 2026-05-01: An unprivileged attacker can craft a user-space process with a malicious ELF binary containing an out-of-range sh_link field. When root-level dtrace attaches…
CVE-2026-21996 - CVSS 5.5 (medium), 2026-05-01: An unprivileged attacker can reliably trigger a crash of the dtrace process with a malicious ELF binary due to an integer Divide-by-Zero in Pbuild_file_symtab()
CVE-2026-21991 - CVSS 5.5 (medium), 2026-03-16: A DTrace component, dtprobed, allows arbitrary file creation through crafted USDT provider names.
CVE-2025-4598 - CVSS 4.7 (medium), 2025-05-30: A vulnerability was found in systemd-coredump. This flaw allows an attacker to force a SUID process to crash and replace it with a non-SUID binary to access…
CVE-2022-21505 - CVSS 6.7 (medium), 2024-12-24: In the linux kernel, if IMA appraisal is used with the "ima_appraise=log" boot param, lockdown can be defeated with kexec on any machine when Secure Boot is…
CVE-2023-22024 - CVSS 5.5 (medium), 2023-09-20: In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant.…
CVE-2022-21385 - CVSS 6.2 (medium), 2022-08-29: A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Base Score 6.2 (Availability impacts).…
CVE-2022-21504 - CVSS 5.5 (medium), 2022-06-14: The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a…
CVE-2022-21499 - CVSS 6.7 (medium), 2022-06-09: KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could…
CVE-2021-3551 - CVSS 7.8 (high), 2022-02-16: A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw…
CVE-2021-2464 - CVSS 7.8 (high), 2021-09-24: Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged…
CVE-2018-17962 - CVSS 7.5 (high), 2018-10-09: Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
CVE-2015-7701 - CVSS 7.5 (high), 2017-08-07: Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service…
CVE-2015-7692 - CVSS 7.5 (high), 2017-08-07: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This…
CVE-2015-7852 - CVSS 5.9 (medium), 2017-08-07: ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.
CVE-2015-7691 - CVSS 7.5 (high), 2017-08-07: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted…
CVE-2015-7702 - CVSS 6.5 (medium), 2017-08-07: The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This…
CVE-2015-7703 - CVSS 7.5 (high), 2017-07-24: The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration,…
CVE-2015-5219 - CVSS 7.5 (high), 2017-07-21: The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote…
CVE-2016-1908 - CVSS 9.8 (critical), 2017-04-11: The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control…
CVE-2015-8896 - CVSS 6.5 (medium), 2017-03-15: Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted…
CVE-2016-2518 - CVSS 5.3 (medium), 2017-01-30: The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer…
CVE-2015-7977 - CVSS 5.9 (medium), 2017-01-30: ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.
CVE-2016-7039 - CVSS 7.5 (high), 2016-10-16: The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified…
CVE-2016-0617 - CVSS 5.5 (medium), 2016-09-30: Unspecified vulnerability in the kernel-uek component in Oracle Linux 6 allows local users to affect availability via unknown vectors.
CVE-2016-2776 - CVSS 7.5 (high), 2016-09-28: buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows…
CVE-2016-7166 - CVSS 5.5 (medium), 2016-09-21: libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption…
CVE-2016-6250 - CVSS 8.6 (high), 2016-09-21: Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute…
CVE-2016-5844 - CVSS 6.5 (medium), 2016-09-21: Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
CVE-2016-5418 - CVSS 7.5 (high), 2016-09-21: The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to…
CVE-2016-4809 - CVSS 7.5 (high), 2016-09-21: The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial…
CVE-2015-8922 - CVSS 5.5 (medium), 2016-09-20: The read_CodersInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL…
CVE-2016-6302 - CVSS 7.5 (high), 2016-09-16: The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows…
CVE-2016-2182 - CVSS 9.8 (critical), 2016-09-16: The BN_bn2dec function in crypto/bn/bn_print.c in OpenSSL before 1.1.0 does not properly validate division results, which allows remote attackers to cause a…
CVE-2016-2181 - CVSS 7.5 (high), 2016-09-16: The Anti-Replay feature in the DTLS implementation in OpenSSL before 1.1.0 mishandles early use of a new epoch number in conjunction with a large sequence…
CVE-2016-2179 - CVSS 7.5 (high), 2016-09-16: The DTLS implementation in OpenSSL before 1.1.0 does not properly restrict the lifetime of queue entries associated with unused out-of-order messages, which…
CVE-2016-5404 - CVSS 6.5 (medium), 2016-09-07: The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary…
CVE-2016-5408 - CVSS 9.8 (critical), 2016-08-10: Stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6…
CVE-2016-6198 - CVSS 5.5 (medium), 2016-08-06: The filesystem layer in the Linux kernel before 4.5.5 proceeds with post-rename operations after an OverlayFS file is renamed to a self-hardlink, which allows…
CVE-2016-6197 - CVSS 5.5 (medium), 2016-08-06: fs/overlayfs/dir.c in the OverlayFS filesystem implementation in the Linux kernel before 4.6 does not properly verify the upper dentry before proceeding with…
CVE-2016-5265 - CVSS 5.5 (medium), 2016-08-05: Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS…
CVE-2016-5264 - CVSS 8.8 (high), 2016-08-05: Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3…
CVE-2016-5263 - CVSS 8.8 (high), 2016-08-05: The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows…
CVE-2016-5262 - CVSS 6.1 (medium), 2016-08-05: Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME…
CVE-2016-5259 - CVSS 8.8 (high), 2016-08-05: Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote…
CVE-2016-5258 - CVSS 8.8 (high), 2016-08-05: Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute…
CVE-2016-5254 - CVSS 9.8 (critical), 2016-08-05: Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to…
CVE-2016-5252 - CVSS 8.8 (high), 2016-08-05: Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers…
CVE-2016-2837 - CVSS 6.3 (medium), 2016-08-05: Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and…
CVE-2016-5403 - CVSS 5.5 (medium), 2016-08-02: The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU…
CVE-2016-2180 - CVSS 7.5 (high), 2016-08-01: The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h…
CVE-2016-5444 - CVSS 3.7 (low), 2016-07-21: Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and…
CVE-2016-5440 - CVSS 4.9 (medium), 2016-07-21: Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and…
CVE-2016-3615 - CVSS 5.3 (medium), 2016-07-21: Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and…
CVE-2016-3610 - CVSS 9.6 (critical), 2016-07-21: Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-3606 - CVSS 9.6 (critical), 2016-07-21: Unspecified vulnerability in Oracle Java SE 7u101 and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and…
CVE-2016-3598 - CVSS 9.6 (critical), 2016-07-21: Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-3587 - CVSS 9.6 (critical), 2016-07-21: Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via…
CVE-2016-3550 - CVSS 4.3 (medium), 2016-07-21: Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors…
CVE-2016-3521 - CVSS 6.5 (medium), 2016-07-21: Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and…
CVE-2016-3508 - CVSS 5.3 (medium), 2016-07-21: Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability…
CVE-2016-3500 - CVSS 5.3 (medium), 2016-07-21: Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability…
CVE-2016-3477 - CVSS 8.1 (high), 2016-07-21: Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and…
CVE-2016-3458 - CVSS 4.3 (medium), 2016-07-21: Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related…
CVE-2016-3452 - CVSS 3.7 (low), 2016-07-21: Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and…
CVE-2016-5388 - CVSS 8.1 (high), 2016-07-19: Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect…
CVE-2016-5387 - CVSS 8.1 (high), 2016-07-19: The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data…
CVE-2016-5386 - CVSS 8.1 (high), 2016-07-19: The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications…
CVE-2016-5385 - CVSS 8.1 (high), 2016-07-19: PHP through 7.0.8 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect applications from the presence of…
CVE-2016-4998 - CVSS 7.1 (high), 2016-07-03: The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service…
CVE-2016-4997 - CVSS 7.8 (high), 2016-07-03: The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users…
CVE-2016-4470 - CVSS 5.5 (medium), 2016-06-27: The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which…
CVE-2016-2178 - CVSS 5.5 (medium), 2016-06-20: The dsa_sign_setup function in crypto/dsa/dsa_ossl.c in OpenSSL through 1.0.2h does not properly ensure the use of constant-time operations, which makes it…
CVE-2016-2177 - CVSS 9.8 (critical), 2016-06-20: OpenSSL through 1.0.2h incorrectly uses pointer arithmetic for heap-buffer boundary checks, which might allow remote attackers to cause a denial of service…
CVE-2016-5118 - CVSS 9.8 (critical), 2016-06-10: The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at…
CVE-2016-4448 - CVSS 9.8 (critical), 2016-06-09: Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.
CVE-2016-5126 - CVSS 7.8 (high), 2016-06-01: Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process…
CVE-2016-4951 - CVSS 7.8 (high), 2016-05-23: The tipc_nl_publ_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local users to cause a…
CVE-2016-4913 - CVSS 7.8 (high), 2016-05-23: The get_rock_ridge_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containing \0 characters,…
CVE-2016-4805 - CVSS 7.8 (high), 2016-05-23: Use-after-free vulnerability in drivers/net/ppp/ppp_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of service (memory…
CVE-2016-4581 - CVSS 5.5 (medium), 2016-05-23: fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, which allows local…
CVE-2015-4643 - CVSS 9.8 (critical), 2016-05-16: Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.42, 5.5.x before 5.5.26, and 5.6.x before 5.6.10 allows remote FTP servers to…
CVE-2016-3710 - CVSS 8.8 (high), 2016-05-11: The VGA module in QEMU improperly performs bounds checking on banked access to video memory, which allows local guest OS administrators to execute arbitrary…
CVE-2016-4556 - CVSS 7.5 (high), 2016-05-10: Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted…
CVE-2016-4555 - CVSS 7.5 (high), 2016-05-10: client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side…
CVE-2016-4554 - CVSS 8.6 (high), 2016-05-10: mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a…
CVE-2016-4553 - CVSS 8.6 (high), 2016-05-10: client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote…
CVE-2016-3718 - CVSS 5.5 (medium), 2016-05-05: The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF)…
CVE-2016-3715 - CVSS 5.5 (medium), 2016-05-05: The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2016-2143 - CVSS 7.8 (high), 2016-04-27: The fork implementation in the Linux kernel before 4.5 on s390 platforms mishandles the case of four page-table levels, which allows local users to cause a…
CVE-2016-4054 - CVSS 8.1 (high), 2016-04-25: Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI)…
CVE-2016-4053 - CVSS 3.7 (low), 2016-04-25: Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI)…
CVE-2016-4051 - CVSS 8.8 (high), 2016-04-25: Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute…
CVE-2016-3427 - CVSS 9.8 (critical), 2016-04-21: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect…
CVE-2016-0695 - CVSS 5.9 (medium), 2016-04-21: Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect…
CVE-2016-0666 - CVSS 5.5 (medium), 2016-04-21: Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and…
CVE-2016-0650 - CVSS 5.5 (medium), 2016-04-21: Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and…
CVE-2016-0649 - CVSS 5.5 (medium), 2016-04-21: Unspecified vulnerability in Oracle MySQL 5.5.47 and earlier, 5.6.28 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.48, 10.0.x before 10.0.24, and…
CVE-2016-0648 - CVSS 5.5 (medium), 2016-04-21: Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and…
CVE-2016-0647 - CVSS 5.5 (medium), 2016-04-21: Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and…