Enterprise Linux Workstation (Redhat) - vulnerabilities (CVEs)

1845 CVEs, 0 in the last 30 days, 11 known versions, newest CVE from 2024-01-31. Vendor: Redhat.

CVEs of Enterprise Linux Workstation

CVE-2024-1086 - CVSS 7.8 (high), 2024-01-31: A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The…
CVE-2024-0409 - CVSS 7.8 (high), 2024-01-18: A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type…
CVE-2024-0408 - CVSS 5.5 (medium), 2024-01-18: A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues…
CVE-2023-6816 - CVSS 9.8 (critical), 2024-01-18: A flaw was found in X.Org server. Both DeviceFocusEvent and the XIQueryPointer reply contain a bit for each logical button currently down. Buttons can be…
CVE-2023-5455 - CVSS 6.5 (medium), 2024-01-10: A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the…
CVE-2023-5869 - CVSS 8.8 (high), 2023-12-10: A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value…
CVE-2023-46847 - CVSS 8.6 (high), 2023-11-03: Squid is vulnerable to a Denial of Service, where a remote attacker can perform buffer overflow attack by writing up to 2 MB of arbitrary data to heap memory…
CVE-2023-5367 - CVSS 7.8 (high), 2023-10-25: A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in…
CVE-2023-3899 - CVSS 7.8 (high), 2023-08-23: A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1…
CVE-2019-8720 - CVSS 8.8 (high), 2023-03-06: A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved…
CVE-2022-4254 - CVSS 8.8 (high), 2023-02-01: sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
CVE-2014-0148 - CVSS 5.5 (medium), 2022-09-29: Qemu before 2.0 block driver for Hyper-V VHDX Images is vulnerable to infinite loops and other potential issues when calculating BAT entries, due to missing…
CVE-2014-0147 - CVSS 6.2 (medium), 2022-09-29: Qemu before 1.6.2 block diver for the various disk image formats used by Bochs and for the QCOW version 2 format, are vulnerable to a possible crash caused by…
CVE-2014-0144 - CVSS 8.6 (high), 2022-09-29: QEMU before 2.0.0 block drivers for CLOOP, QCOW2 version 2 and various other image formats are vulnerable to potential memory corruptions, integer/buffer…
CVE-2015-1931 - CVSS 5.5 (medium), 2022-09-29: IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR1 FP10, 7 R1 before SR3 FP10, 7 before SR9 FP10, 6 R1 before SR8 FP7, 6 before…
CVE-2022-2738 - CVSS 7.5 (high), 2022-09-01: The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix…
CVE-2022-2739 - CVSS 5.3 (medium), 2022-09-01: The version of podman as released for Red Hat Enterprise Linux 7 Extras via RHSA-2022:2190 advisory included an incorrect version of podman missing the fix…
CVE-2022-1227 - CVSS 8.8 (high), 2022-04-29: A privilege escalation flaw was found in Podman. This flaw allows an attacker to publish a malicious image to a public registry. Once this image is downloaded…
CVE-2022-0330 - CVSS 7.8 (high), 2022-03-25: A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This…
CVE-2021-3656 - CVSS 8.8 (high), 2022-03-04: A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block)…
CVE-2021-44142 - CVSS 8.8 (high), 2022-02-21: The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a…
CVE-2021-4091 - CVSS 7.5 (high), 2022-02-18: A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests,…
CVE-2020-25719 - CVSS 7.2 (high), 2022-02-18: A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become…
CVE-2020-25717 - CVSS 8.1 (high), 2022-02-18: A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
CVE-2016-2124 - CVSS 5.9 (medium), 2022-02-18: A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even…
CVE-2021-4034 - CVSS 7.8 (high), 2022-01-28: A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users…
CVE-2021-3622 - CVSS 4.3 (medium), 2021-12-23: A flaw was found in the hivex library. This flaw allows an attacker to input a specially crafted Windows Registry (hive) file, which would cause hivex to…
CVE-2021-3672 - CVSS 5.6 (medium), 2021-11-23: A flaw was found in c-ares library, where a missing input validation check of host names returned by DNS (Domain Name Servers) can lead to output of wrong…
CVE-2021-40438 - CVSS 9 (critical), 2021-09-16: A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server…
CVE-2021-20233 - CVSS 8.2 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. Setparam_prefix() in the menu rendering code performs a length calculation on the assumption that…
CVE-2020-14372 - CVSS 7.5 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06, where it incorrectly enables the usage of the ACPI command when Secure Boot is enabled. This flaw allows…
CVE-2020-27749 - CVSS 6.7 (medium), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. Variable names present are expanded in the supplied command line into their corresponding variable…
CVE-2020-25647 - CVSS 7.6 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. During USB device initialization, descriptors are read with very little bounds checking and assumes the…
CVE-2021-20225 - CVSS 6.7 (medium), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The option parser allows an attacker to write past the end of a heap-allocated buffer by calling certain…
CVE-2020-25632 - CVSS 8.2 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The rmmod implementation allows the unloading of a module used as a dependency without checking if any…
CVE-2020-27779 - CVSS 7.5 (high), 2021-03-03: A flaw was found in grub2 in versions prior to 2.06. The cutmem command does not honor secure boot locking allowing an privileged attacker to remove address…
CVE-2020-3864 - CVSS 7.8 (high), 2020-10-27: A logic issue was addressed with improved validation. This issue is fixed in iCloud for Windows 7.17, iTunes 12.10.4 for Windows, iCloud for Windows 10.9.2,…
CVE-2019-8846 - CVSS 8.8 (high), 2020-10-27: A use after free issue was addressed with improved memory management. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS 13.3,…
CVE-2019-8844 - CVSS 8.8 (high), 2020-10-27: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, watchOS 6.1.1, iCloud for Windows 10.9, iOS…
CVE-2019-8835 - CVSS 8.8 (high), 2020-10-27: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in tvOS 13.3, iCloud for Windows 10.9, iOS 13.3 and iPadOS…
CVE-2020-10531 - CVSS 8.8 (high), 2020-03-12: An issue was discovered in International Components for Unicode (ICU) for C/C++ through 66.1. An integer overflow, leading to a heap-based buffer overflow,…
CVE-2020-6383 - CVSS 8.8 (high), 2020-02-27: Type confusion in V8 in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-6418 - CVSS 8.8 (high), 2020-02-27: Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-6386 - CVSS 8.8 (high), 2020-02-27: Use after free in speech in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-6384 - CVSS 8.8 (high), 2020-02-27: Use after free in WebAudio in Google Chrome prior to 80.0.3987.116 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-3757 - CVSS 8.8 (high), 2020-02-13: Adobe Flash Player versions 32.0.0.321 and earlier, 32.0.0.314 and earlier, 32.0.0.321 and earlier, and 32.0.0.255 and earlier have a type confusion…
CVE-2020-8945 - CVSS 7.5 (high), 2020-02-12: The proglottis Go wrapper before 0.1.1 for the GPGME library has a use-after-free, as demonstrated by use for container image pulls by Docker or CRI-O. This…
CVE-2013-4535 - CVSS 8.8 (high), 2020-02-11: The virtqueue_map_sg function in hw/virtio/virtio.c in QEMU before 1.7.2 allows remote attackers to execute arbitrary files via a crafted savevm image,…
CVE-2020-6416 - CVSS 8.8 (high), 2020-02-11: Insufficient data validation in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted…
CVE-2020-6415 - CVSS 8.8 (high), 2020-02-11: Inappropriate implementation in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a…
CVE-2020-6397 - CVSS 6.5 (medium), 2020-02-11: Inappropriate implementation in sharing in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof security UI via a crafted HTML page.
CVE-2020-6402 - CVSS 8.8 (high), 2020-02-11: Insufficient policy enforcement in downloads in Google Chrome on OS X prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious…
CVE-2020-6406 - CVSS 8.8 (high), 2020-02-11: Use after free in audio in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-6396 - CVSS 4.3 (medium), 2020-02-11: Inappropriate implementation in Skia in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a…
CVE-2020-6400 - CVSS 6.5 (medium), 2020-02-11: Inappropriate implementation in CORS in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-6404 - CVSS 8.8 (high), 2020-02-11: Inappropriate implementation in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted…
CVE-2020-6398 - CVSS 8.8 (high), 2020-02-11: Use of uninitialized data in PDFium in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF…
CVE-2020-6403 - CVSS 4.3 (medium), 2020-02-11: Incorrect implementation in Omnibox in Google Chrome on iOS prior to 80.0.3987.87 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via…
CVE-2020-6408 - CVSS 6.5 (medium), 2020-02-11: Insufficient policy enforcement in CORS in Google Chrome prior to 80.0.3987.87 allowed a local attacker to obtain potentially sensitive information via a…
CVE-2020-6393 - CVSS 6.5 (medium), 2020-02-11: Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVE-2020-6385 - CVSS 8.8 (high), 2020-02-11: Insufficient policy enforcement in storage in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVE-2020-6392 - CVSS 4.3 (medium), 2020-02-11: Insufficient policy enforcement in extensions in Google Chrome prior to 80.0.3987.87 allowed an attacker who convinced a user to install a malicious extension…
CVE-2020-6382 - CVSS 8.8 (high), 2020-02-11: Type confusion in JavaScript in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2020-6391 - CVSS 4.3 (medium), 2020-02-11: Insufficient validation of untrusted input in Blink in Google Chrome prior to 80.0.3987.87 allowed a local attacker to bypass content security policy via a…
CVE-2020-6394 - CVSS 5.4 (medium), 2020-02-11: Insufficient policy enforcement in Blink in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to bypass content security policy via a crafted HTML…
CVE-2020-6381 - CVSS 8.8 (high), 2020-02-11: Integer overflow in JavaScript in Google Chrome on ChromeOS and Android prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption…
CVE-2020-6390 - CVSS 8.8 (high), 2020-02-11: Out of bounds memory access in streams in Google Chrome prior to 80.0.3987.87 allowed a remote attacker to potentially exploit heap corruption via a crafted…
CVE-2012-4512 - CVSS 8.8 (high), 2020-02-08: The CSS parser (khtml/css/cssparser.cpp) in Konqueror in KDE 4.7.3 allows remote attackers to cause a denial of service (crash) and possibly read memory via a…
CVE-2019-15605 - CVSS 9.8 (critical), 2020-02-07: HTTP request smuggling in Node.js 10, 12, and 13 causes malicious payload delivery when transfer-encoding is malformed
CVE-2013-4166 - CVSS 7.5 (high), 2020-02-06: The gpg_ctx_add_recipient function in camel/camel-gpg-context.c in GNOME Evolution 3.8.4 and earlier and Evolution Data Server 3.9.5 and earlier does not…
CVE-2014-8141 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the getZip64Data function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…
CVE-2014-8140 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the test_compr_eb function in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…
CVE-2014-8139 - CVSS 7.8 (high), 2020-01-31: Heap-based buffer overflow in the CRC32 verification in Info-ZIP UnZip 6.0 and earlier allows remote attackers to execute arbitrary code via a crafted zip…
CVE-2011-4088 - CVSS 7.5 (high), 2020-01-31: ABRT might allow attackers to obtain sensitive information from crash reports.
CVE-2020-2659 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241 and…
CVE-2020-2654 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE product of Oracle Java SE (component: Libraries). Supported versions that are affected are Java SE: 7u241, 8u231, 11.0.5 and…
CVE-2020-2604 - CVSS 8.1 (high), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2601 - CVSS 6.8 (medium), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2583 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2593 - CVSS 4.8 (medium), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Networking). Supported versions that are affected are Java SE: 7u241,…
CVE-2020-2590 - CVSS 3.7 (low), 2020-01-15: Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Security). Supported versions that are affected are Java SE: 7u241,…
CVE-2015-3147 - CVSS 6.5 (medium), 2020-01-14: daemon/abrt-handle-upload.in in Automatic Bug Reporting Tool (ABRT), when moving problem reports from /var/spool/abrt-upload, allows local users to write to…
CVE-2014-7844 - CVSS 7.8 (high), 2020-01-14: BSD mailx 8.1.2 and earlier allows remote attackers to execute arbitrary commands via a crafted email address.
CVE-2020-6851 - CVSS 7.5 (high), 2020-01-13: OpenJPEG through 2.3.1 has a heap-based buffer overflow in opj_t1_clbl_decode_processor in openjp2/t1.c because of lack of opj_j2k_update_image_dimensions…
CVE-2020-6377 - CVSS 8.8 (high), 2020-01-10: Use after free in audio in Google Chrome prior to 79.0.3945.117 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVE-2019-17022 - CVSS 6.1 (medium), 2020-01-08: When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer does not escape < and > characters. Because the resulting…
CVE-2019-17017 - CVSS 8.8 (high), 2020-01-08: Due to a missing case handling object types, a type confusion vulnerability could occur, resulting in a crash. We presume that with enough effort that it…
CVE-2019-17016 - CVSS 6.1 (medium), 2020-01-08: When pasting a <style> tag from the clipboard into a rich text editor, the CSS sanitizer incorrectly rewrites a @namespace rule. This could allow for…
CVE-2019-17024 - CVSS 8.8 (high), 2020-01-08: Mozilla developers reported memory safety bugs present in Firefox 71 and Firefox ESR 68.3. Some of these bugs showed evidence of memory corruption and we…
CVE-2019-19925 - CVSS 7.5 (high), 2019-12-24: zipfileUpdate in ext/misc/zipfile.c in SQLite 3.30.1 mishandles a NULL pathname during an update of a ZIP archive.
CVE-2019-19923 - CVSS 7.5 (high), 2019-12-24: flattenSubquery in select.c in SQLite 3.30.1 mishandles certain uses of SELECT DISTINCT involving a LEFT JOIN in which the right-hand side is a view. This can…
CVE-2019-19926 - CVSS 7.5 (high), 2019-12-23: multiSelect in select.c in SQLite 3.30.1 mishandles certain errors during parsing, as demonstrated by errors from sqlite3WindowRewrite() calls. NOTE: this…
CVE-2018-1311 - CVSS 8.1 (high), 2019-12-18: The Apache Xerces-C 3.0.0 to 3.2.3 XML parser contains a use-after-free error triggered during the scanning of external DTDs. This flaw has not been addressed…
CVE-2019-8816 - CVSS 8.8 (high), 2019-12-18: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, watchOS 6.1,…
CVE-2019-8815 - CVSS 8.8 (high), 2019-12-18: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3,…
CVE-2019-8814 - CVSS 8.8 (high), 2019-12-18: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 13.2 and iPadOS 13.2, tvOS 13.2, Safari 13.0.3,…
CVE-2019-8689 - CVSS 8.8 (high), 2019-12-18: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3,…
CVE-2019-8688 - CVSS 8.8 (high), 2019-12-18: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3,…
CVE-2019-8684 - CVSS 8.8 (high), 2019-12-18: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3,…
CVE-2019-8676 - CVSS 8.8 (high), 2019-12-18: Multiple memory corruption issues were addressed with improved memory handling. This issue is fixed in iOS 12.4, macOS Mojave 10.14.6, tvOS 12.4, watchOS 5.3,…