Linux (Redhat) - vulnerabilities (CVEs)

229 CVEs, 0 in the last 30 days, 65 known versions, newest CVE from 2023-11-28. Vendor: Redhat.

CVEs of Linux

• CVE-2023-5981 - CVSS 5.9 (medium), 2023-11-28: A vulnerability was found that the response times to malformed ciphertexts in RSA-PSK ClientKeyExchange differ from response times of ciphertexts with correct…
• CVE-2018-20346 - CVSS 8.1 (high), 2018-12-21: SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after…
• CVE-2018-17962 - CVSS 7.5 (high), 2018-10-09: Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.
• CVE-2014-3250 - CVSS 6.5 (medium), 2017-12-11: The default vhost configuration file in Puppet before 3.6.2 does not include the SSLCARevocationCheck directive, which might allow remote attackers to obtain…
• CVE-2016-3699 - CVSS 7.4 (high), 2016-10-07: The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to…
• CVE-2007-5079 - CVSS 6 (medium), 2007-09-25: Red Hat Enterprise Linux 4 does not properly compile and link gdm with tcp_wrappers on x86_64 platforms, which might allow remote attackers to bypass intended…
• CVE-2007-3379 - CVSS 2.1 (low), 2007-09-17: Unspecified vulnerability in the kernel in Red Hat Enterprise Linux (RHEL) 4 on the x86_64 platform allows local users to cause a denial of service (OOPS) via…
• CVE-2007-3103 - CVSS 6.2 (medium), 2007-07-15: The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a…
• CVE-2007-1352 - CVSS 3.8 (low), 2007-04-06: Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long…
• CVE-2005-3624 - CVSS 5 (medium), 2005-12-31: The CCITTFaxStream::CCITTFaxStream function in Stream.cc for xpdf, gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others allows attackers to…
• CVE-2005-3626 - CVSS 5 (medium), 2005-12-31: Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service (crash)…
• CVE-2005-3625 - CVSS 10 (critical), 2005-12-31: Xpdf, as used in products such as gpdf, kpdf, pdftohtml, poppler, teTeX, CUPS, libextractor, and others, allows attackers to cause a denial of service…
• CVE-2005-0206 - CVSS 7.5 (high), 2005-04-27: The patch for integer overflow vulnerabilities in Xpdf 2.0 and 3.0 (CVE-2004-0888) is incomplete for 64-bit architectures on certain Linux distributions such…
• CVE-2004-1235 - CVSS 6.2 (medium), 2005-04-14: Race condition in the (1) load_elf_library and (2) binfmt_aout function calls for uselib in Linux kernel 2.4 through 2.429-rc2 and 2.6 through 2.6.10 allows…
• CVE-2005-0750 - CVSS 7.2 (high), 2005-03-27: The bluez_sock_create function in the Bluetooth stack for Linux kernel 2.4.6 through 2.4.30-rc1 and 2.6 through 2.6.11.5 allows local users to gain privileges…
• CVE-2004-0903 - CVSS 10 (critical), 2005-01-27: Stack-based buffer overflow in the writeGroup function in nsVCardObj.cpp for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird…
• CVE-2004-0902 - CVSS 10 (critical), 2005-01-27: Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to…
• CVE-2004-1026 - CVSS 10 (critical), 2005-01-10: Multiple integer overflows in the image handler for imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to…
• CVE-2004-1025 - CVSS 10 (critical), 2005-01-10: Multiple heap-based buffer overflows in imlib 1.9.14 and earlier, which is used by gkrellm and several window managers, allow remote attackers to cause a…
• CVE-2004-0904 - CVSS 10 (critical), 2004-12-31: Integer overflow in the bitmap (BMP) decoder for Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote…
• CVE-2004-1335 - CVSS 2.1 (low), 2004-12-15: Memory leak in the ip_options_get function in the Linux kernel before 2.6.10 allows local users to cause a denial of service (memory consumption) by…
• CVE-2004-1333 - CVSS 2.1 (low), 2004-12-15: Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a…
• CVE-2004-0619 - CVSS 7.2 (high), 2004-12-06: Integer overflow in the ubsec_keysetup function for Linux Broadcom 5820 cryptonet driver allows local users to cause a denial of service (crash) and possibly…
• CVE-2004-0112 - CVSS 5 (medium), 2004-11-23: The SSL/TLS handshaking code in OpenSSL 0.9.7a, 0.9.7b, and 0.9.7c, when using Kerberos ciphersuites, does not properly check the length of Kerberos tickets…
• CVE-2004-0081 - CVSS 5 (medium), 2004-11-23: OpenSSL 0.9.6 before 0.9.6d does not properly handle unknown message types, which allows remote attackers to cause a denial of service (infinite loop), as…
• CVE-2004-0079 - CVSS 7.5 (high), 2004-11-23: The do_change_cipher_spec function in OpenSSL 0.9.6c to 0.9.6k, and 0.9.7a to 0.9.7c, allows remote attackers to cause a denial of service (crash) via a…
• CVE-2004-1613 - CVSS 5 (medium), 2004-10-18: Mozilla allows remote attackers to cause a denial of service (application crash from null dereference or infinite loop) via a web page that contains a (1)…
• CVE-2004-0905 - CVSS 4.6 (medium), 2004-09-14: Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allows remote attackers to perform cross-domain scripting and…
• CVE-2003-0989 - CVSS 7.5 (high), 2004-02-17: tcpdump before 3.8.1 allows remote attackers to cause a denial of service (infinite loop) via certain ISAKMP packets, a different vulnerability than…
• CVE-2003-0461 - CVSS 2.1 (low), 2003-08-27: /proc/tty/driver/serial in Linux 2.4.x reveals the exact number of characters used in serial links, which could allow local users to obtain potentially…
• CVE-2003-0551 - CVSS 5 (medium), 2003-08-27: The STP protocol implementation in Linux 2.4.x does not properly verify certain lengths, which could allow attackers to cause a denial of service.
• CVE-2003-0550 - CVSS 5 (medium), 2003-08-27: The STP protocol, as enabled in Linux 2.4.x, does not provide sufficient security by design, which allows attackers to modify the bridge topology.
• CVE-2003-0464 - CVSS 4.6 (medium), 2003-08-27: The RPC code in Linux kernel 2.4 sets the reuse flag when sockets are created, which could allow local users to bind to UDP ports that are used by privileged…
• CVE-2003-0552 - CVSS 5 (medium), 2003-08-27: Linux 2.4.x allows remote attackers to spoof the bridge Forwarding table via forged packets whose source addresses are the same as the target.
• CVE-2003-0442 - CVSS 4.3 (medium), 2003-07-24: Cross-site scripting (XSS) vulnerability in the transparent SID support capability for PHP before 4.3.2 (session.use_trans_sid) allows remote attackers to…
• CVE-2003-0434 - CVSS 7.5 (high), 2003-07-24: Various PDF viewers including (1) Adobe Acrobat 5.06 and (2) Xpdf 1.01 allow remote attackers to execute arbitrary commands via shell metacharacters in an…
• CVE-2003-0248 - CVSS 10 (critical), 2003-06-16: The mxcsr code in Linux kernel 2.4 allows attackers to modify CPU state registers via a malformed address.
• CVE-2003-0370 - CVSS 7.5 (high), 2003-06-16: Konqueror Embedded and KDE 2.2.2 and earlier does not validate the Common Name (CN) field for X.509 Certificates, which could allow remote attackers to spoof…
• CVE-2003-0247 - CVSS 5 (medium), 2003-06-16: Unknown vulnerability in the TTY layer of the Linux kernel 2.4 allows attackers to cause a denial of service ("kernel oops").
• CVE-2003-0364 - CVSS 5 (medium), 2003-06-16: The TCP/IP fragment reassembly handling in the Linux kernel 2.4 allows remote attackers to cause a denial of service (CPU consumption) via certain packets…
• CVE-2002-1155 - CVSS 7.2 (high), 2003-06-16: Buffer overflow in KON kon2 0.3.9b and earlier allows local users to execute arbitrary code via a long -Coding command line argument.
• CVE-2003-0354 - CVSS 7.5 (high), 2003-06-16: Unknown vulnerability in GNU Ghostscript before 7.07 allows attackers to execute arbitrary commands, even when -dSAFER is enabled, via a PostScript file that…
• CVE-2003-0188 - CVSS 7.2 (high), 2003-06-09: lv reads a .lv file from the current working directory, which allows local users to execute arbitrary commands as other lv users by placing malicious .lv…
• CVE-2003-0194 - CVSS 4.6 (medium), 2003-06-09: tcpdump does not properly drop privileges to the pcap user when starting up.
• CVE-2003-0135 - CVSS 7.5 (high), 2003-04-11: vsftpd FTP daemon in Red Hat Linux 9 is not compiled against TCP wrappers (tcp_wrappers) but is installed as a standalone service, which inadvertently…
• CVE-2002-1509 - CVSS 3.6 (low), 2003-03-03: A patch for shadow-utils 20000902 causes the useradd command to create a mail spool files with read/write privileges of the new user's group (mode 660), which…
• CVE-2003-0041 - CVSS 10 (critical), 2003-02-19: Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.
• CVE-2003-0019 - CVSS 7.2 (high), 2003-02-19: uml_net in the kernel-utils package for Red Hat Linux 8.0 has incorrect setuid root privileges, which allows local users to modify network interfaces, e.g. by…
• CVE-2002-1160 - CVSS 7.2 (high), 2003-02-19: The default configuration of the pam_xauth module forwards MIT-Magic-Cookies to new X sessions, which could allow local users to gain root privileges by…
• CVE-2002-2185 - CVSS 4.9 (medium), 2002-12-31: The Internet Group Management Protocol (IGMP) allows local users to cause a denial of service via an IGMP membership report to a target's Ethernet address…
• CVE-2002-1814 - CVSS 4.6 (medium), 2002-12-31: Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via long command line arguments.
• CVE-2002-1232 - CVSS 5 (medium), 2002-11-04: Memory leak in ypdb_open in yp_db.c for ypserv before 2.5 in the NIS package 3.9 and earlier allows remote attackers to cause a denial of service (memory…
• CVE-2002-0836 - CVSS 7.5 (high), 2002-10-28: dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands…
• CVE-2000-1208 - CVSS 7.2 (high), 2002-08-12: Format string vulnerability in startprinting() function of printjob.c in BSD-based lpr lpd package may allow local users to gain privileges via an improper…
• CVE-2002-0638 - CVSS 6.2 (medium), 2002-08-12: setpwnam.c in the util-linux package, as included in Red Hat Linux 7.3 and earlier, and other operating systems, does not properly lock a temporary file when…
• CVE-2002-0506 - CVSS 7.2 (high), 2002-08-12: Buffer overflow in newt.c of newt windowing library (libnewt) 0.50.33 and earlier may allow attackers to cause a denial of service or execute arbitrary code…
• CVE-2002-0083 - CVSS 9.8 (critical), 2002-03-15: Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges.
• CVE-2002-0080 - CVSS 2.1 (low), 2002-03-15: rsync, when running in daemon mode, does not properly call setgroups before dropping privileges, which could provide supplemental group privileges to local…
• CVE-2002-0068 - CVSS 7.5 (high), 2002-03-08: Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service (core dump) and possibly execute arbitrary code with an ftp:// URL with a…
• CVE-2002-0067 - CVSS 7.5 (high), 2002-03-08: Squid 2.4 STABLE3 and earlier does not properly disable HTCP, even when "htcp_port 0" is specified in squid.conf, which could allow remote attackers to bypass…
• CVE-2002-0062 - CVSS 7.2 (high), 2002-03-08: Buffer overflow in ncurses 5.0, and the ncurses4 compatibility package as used in Red Hat Linux, allows local users to gain privileges, related to "routines…
• CVE-2002-0069 - CVSS 2.6 (low), 2002-03-08: Memory leak in SNMP in Squid 2.4 STABLE3 and earlier allows remote attackers to cause a denial of service.
• CVE-2002-0004 - CVSS 7.2 (high), 2002-02-27: Heap corruption vulnerability in the "at" program allows local users to execute arbitrary code via a malformed execution time, which causes at to free the…
• CVE-2002-0002 - CVSS 7.5 (high), 2002-01-31: Format string vulnerability in stunnel before 3.22 when used in client mode for (1) smtp, (2) pop, or (3) nntp allows remote malicious servers to execute…
• CVE-2002-0045 - CVSS 7.5 (high), 2002-01-31: slapd in OpenLDAP 2.0 through 2.0.19 allows local users, and anonymous users before 2.0.8, to conduct a "replace" action on access controls without any…
• CVE-2002-0044 - CVSS 3.6 (low), 2002-01-31: GNU Enscript 1.6.1 and earlier allows local users to overwrite arbitrary files of the Enscript user via a symlink attack on temporary files.
• CVE-2001-0869 - CVSS 7.5 (high), 2001-12-21: Format string vulnerability in the default logging callback function _sasl_syslog in common.c in Cyrus SASL library (cyrus-sasl) may allow remote attackers to…
• CVE-2001-0886 - CVSS 4.6 (medium), 2001-12-21: Buffer overflow in glob function of glibc allows attackers to cause a denial of service (crash) and possibly execute arbitrary code via a glob pattern that…
• CVE-2001-0872 - CVSS 7.2 (high), 2001-12-21: OpenSSH 3.0.1 and earlier with UseLogin enabled does not properly cleanse critical environment variables such as LD_PRELOAD, which allows local users to gain…
• CVE-2001-0889 - CVSS 7.5 (high), 2001-12-19: Exim 3.22 and earlier, in some configurations, does not properly verify the local part of an address when redirecting the address to a pipe, which could allow…
• CVE-2001-0852 - CVSS 5 (medium), 2001-12-06: TUX HTTP server 2.1.0-2 in Red Hat Linux allows remote attackers to cause a denial of service via a long Host: header.
• CVE-2001-0859 - CVSS 5 (medium), 2001-12-06: 2.4.3-12 kernel in Red Hat Linux 7.1 Korean installation program sets the setting default umask for init to 000, which installs files with world-writeable…
• CVE-2001-0946 - CVSS 3.6 (low), 2001-12-04: apmscript in Apmd in Red Hat 7.2 "Enigma" allows local users to create or change the modification dates of arbitrary files via a symlink attack on the…
• CVE-2001-0787 - CVSS 4.6 (medium), 2001-10-18: LPRng in Red Hat Linux 7.0 and 7.1 does not properly drop memberships in supplemental groups when lowering privileges, which could allow a local user to…
• CVE-2001-0736 - CVSS 2.1 (low), 2001-10-18: Vulnerability in (1) pine before 4.33 and (2) the pico editor, included with pine, allows local users local users to overwrite arbitrary files via a symlink…
• CVE-2001-1383 - CVSS 6.2 (medium), 2001-09-26: initscript in setserial 2.17-4 and earlier uses predictable temporary file names, which could allow local users to conduct unauthorized operations on files.
• CVE-2001-0690 - CVSS 7.5 (high), 2001-09-20: Format string vulnerability in exim (3.22-10 in Red Hat, 3.12 in Debian and 3.16 in Conectiva) in batched SMTP mode allows a remote attacker to execute…
• CVE-2001-0641 - CVSS 4.6 (medium), 2001-09-20: Buffer overflow in man program in various distributions of Linux allows local user to execute arbitrary code as group man via a long -S option.
• CVE-2001-1013 - CVSS 5 (medium), 2001-09-12: Apache on Red Hat Linux with with the UserDir directive enabled generates different error codes when a username exists and there is no public_html directory…
• CVE-2001-1002 - CVSS 7.5 (high), 2001-08-31: The default configuration of the DVI print filter (dvips) in Red Hat Linux 7.0 and earlier does not run dvips in secure mode when dvips is executed by lpd,…
• CVE-2001-0635 - CVSS 4.6 (medium), 2001-08-14: Red Hat Linux 7.1 sets insecure permissions on swap files created during installation, which can allow a local attacker to gain additional privileges by…
• CVE-2001-1375 - CVSS 4.6 (medium), 2001-07-19: tcl/tk package (tcltk) 8.3.1 searches for its libraries in the current working directory before other directories, which could allow local users to execute…
• CVE-2001-1374 - CVSS 7.2 (high), 2001-07-19: expect before 5.32 searches for its libraries in /var/tmp before other directories, which could allow local users to gain root privileges via a Trojan horse…
• CVE-2001-1030 - CVSS 7.5 (high), 2001-07-18: Squid before 2.3STABLE5 in HTTP accelerator mode does not enable access control lists (ACLs) when the httpd_accel_host and http_accel_with_proxy off settings…
• CVE-2001-0977 - CVSS 5 (medium), 2001-07-16: slapd in OpenLDAP 1.x before 1.2.12, and 2.x before 2.0.8, allows remote attackers to cause a denial of service (crash) via an invalid Basic Encoding Rules…
• CVE-2001-0439 - CVSS 7.5 (high), 2001-07-02: licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.
• CVE-2001-0473 - CVSS 7.5 (high), 2001-06-27: Format string vulnerability in Mutt before 1.2.5 allows a remote malicious IMAP server to execute arbitrary commands.
• CVE-2001-0441 - CVSS 7.5 (high), 2001-06-27: Buffer overflow in (1) wrapping and (2) unwrapping functions of slrn news reader before 0.9.7.0 allows remote attackers to execute arbitrary commands via a…
• CVE-2001-0496 - CVSS 4.6 (medium), 2001-06-27: kdesu in kdelibs package creates world readable temporary files containing authentication info, which can allow local users to gain privileges.
• CVE-2001-0309 - CVSS 5 (medium), 2001-06-02: inetd in Red Hat 6.2 does not properly close sockets for internal services such as chargen, daytime, echo, etc., which allows remote attackers to cause a…
• CVE-2001-1028 - CVSS 7.2 (high), 2001-05-28: Buffer overflow in ultimate_source function of man 1.5 and earlier allows local users to gain privileges.
• CVE-2001-0169 - CVSS 2.1 (low), 2001-03-26: When using the LD_PRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also…
• CVE-2001-0233 - CVSS 10 (critical), 2001-03-26: Buffer overflow in micq client 0.4.6 and earlier allows remote attackers to cause a denial of service, and possibly execute arbitrary commands, via a long…
• CVE-2001-0197 - CVSS 10 (critical), 2001-03-26: Format string vulnerability in print_client in icecast 1.3.8beta2 and earlier allows remote attackers to execute arbitrary commands.
• CVE-2001-0170 - CVSS 2.1 (low), 2001-03-26: glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid…
• CVE-2001-0118 - CVSS 1.2 (low), 2001-03-12: rdist 6.1.5 allows local users to overwrite arbitrary files via a symlink attack.
• CVE-2001-0128 - CVSS 7.2 (high), 2001-03-12: Zope before 2.2.4 does not properly compute local roles, which could allow users to bypass specified access restrictions and gain privileges.
• CVE-2001-0140 - CVSS 1.2 (low), 2001-03-12: arpwatch 2.1a4 allows local users to overwrite arbitrary files via a symlink attack in some configurations.
• CVE-2000-0314 - CVSS 5 (medium), 2001-03-12: traceroute in NetBSD 1.3.3 and Linux systems allows local users to flood other systems by providing traceroute with a large waittime (-w) option, which is not…
• CVE-2001-0117 - CVSS 1.2 (low), 2001-03-12: sdiff 2.7 in the diffutils package allows local users to overwrite files via a symlink attack.