7.3 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:redhat:enterprise_linux_eus:7.3:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2019-0223			2019-04-23	2022-04-22	5.8	None	Remote	Medium	Not required	Partial	Partial	None
While investigating bug PROTON-2014, we discovered that under some circumstances Apache Qpid Proton versions 0.9 to 0.27.0 (C library and its language bindings) can connect to a peer anonymously using TLS even when configured to verify the peer certificate while used with OpenSSL versions before 1.1.0. This means that an undetected man in the middle attack could be constructed if an attacker can arrange to intercept TLS traffic.
2	CVE-2018-3639	203	Bypass	2018-05-22	2021-08-13	2.1	None	Local	Low	Not required	Partial	None	None
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis, aka Speculative Store Bypass (SSB), Variant 4.
3	CVE-2017-18017	416	DoS Mem. Corr.	2018-01-03	2022-04-22	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the presence of xt_TCPMSS in an iptables action.
4	CVE-2017-12613	125	DoS	2017-10-24	2022-04-18	3.6	None	Local	Low	Not required	Partial	None	Partial
When apr_time_exp() or apr_os_exp_time() functions are invoked with an invalid month field value in Apache Portable Runtime APR 1.6.2 and prior, out of bounds memory may be accessed in converting this value to an apr_time_exp_t value, potentially revealing the contents of a different static heap value or resulting in program termination, and may represent an information disclosure or denial of service vulnerability to applications which call these APR functions with unvalidated external input.
5	CVE-2017-7668	125		2017-06-20	2022-04-21	5.0	None	Remote	Low	Not required	None	None	Partial
The HTTP strict parsing changes added in Apache httpd 2.2.32 and 2.4.24 introduced a bug in token list parsing, which allows ap_find_token() to search past the end of its input string. By maliciously crafting a sequence of request headers, an attacker may be able to cause a segmentation fault, or to force ap_find_token() to return an incorrect value.
6	CVE-2017-3167	287	Bypass	2017-06-20	2021-06-06	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
In Apache httpd 2.2.x before 2.2.33 and 2.4.x before 2.4.26, use of the ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.
7	CVE-2016-9901	20	Exec Code	2018-06-11	2018-08-01	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-saved" (unprivileged) page, giving it access to Pocket's messaging API through HTML injection. This vulnerability affects Firefox ESR < 45.6 and Firefox < 50.1.
8	CVE-2016-9560	787	Overflow	2017-02-15	2021-03-15	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Stack-based buffer overflow in the jpc_tsfb_getbands2 function in jpc_tsfb.c in JasPer before 1.900.30 allows remote attackers to have unspecified impact via a crafted image.
9	CVE-2016-9131	20	DoS	2017-01-12	2020-08-19	5.0	None	Remote	Low	Not required	None	None	Partial
named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a malformed response to an RTYPE ANY query.
10	CVE-2016-8864	617	DoS	2016-11-02	2020-08-17	5.0	None	Remote	Low	Not required	None	None	Partial
named in ISC BIND 9.x before 9.9.9-P4, 9.10.x before 9.10.4-P4, and 9.11.x before 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a DNAME record in the answer section of a response to a recursive query, related to db.c and resolver.c.
11	CVE-2016-7163	190	Exec Code Overflow	2016-09-21	2022-04-07	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which triggers an out-of-bounds read or write.
12	CVE-2016-5126	787	DoS Exec Code Overflow	2016-06-01	2021-08-04	4.6	None	Local	Low	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the iscsi_aio_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (QEMU process crash) or possibly execute arbitrary code via a crafted iSCSI asynchronous I/O ioctl call.
13	CVE-2016-5011		DoS	2017-04-11	2020-09-11	4.9	None	Local	Low	Not required	None	None	Complete
The parse_dos_extended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.
14	CVE-2016-2857	119	DoS Overflow	2016-04-12	2021-08-04	3.6	None	Local	Low	Not required	Partial	None	Partial
The net_checksum_calculate function in net/checksum.c in QEMU allows local guest OS users to cause a denial of service (out-of-bounds heap read and crash) via the payload length in a crafted packet.
15	CVE-2016-2775	20	DoS	2016-07-19	2020-08-25	4.3	None	Remote	Medium	Not required	None	None	Partial
ISC BIND 9.x before 9.9.9-P2, 9.10.x before 9.10.4-P2, and 9.11.x before 9.11.0b2, when lwresd or the named lwres option is enabled, allows remote attackers to cause a denial of service (daemon crash) via a long request that uses the lightweight resolver protocol.
16	CVE-2015-8896		DoS	2017-03-15	2021-04-28	4.3	None	Remote	Medium	Not required	None	None	Partial
Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.
17	CVE-2015-8631	772	DoS	2016-02-13	2021-02-02	4.0	None	Remote	Low	???	None	None	Partial
Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service (memory consumption) via a request specifying a NULL principal name.
18	CVE-2015-8629	125	DoS +Info	2016-02-13	2021-02-02	2.1	None	Remote	High	???	Partial	None	None
The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
19	CVE-2015-8126	120	DoS Overflow	2015-11-13	2022-05-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Multiple buffer overflows in the (1) png_set_PLTE and (2) png_get_PLTE functions in libpng before 1.0.64, 1.1.x and 1.2.x before 1.2.54, 1.3.x and 1.4.x before 1.4.17, 1.5.x before 1.5.24, and 1.6.x before 1.6.19 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a small bit-depth value in an IHDR (aka image header) chunk in a PNG image.
20	CVE-2015-5160	200	+Info	2018-08-20	2020-10-15	2.1	None	Local	Low	Not required	Partial	None	None
libvirt before 2.2 includes Ceph credentials on the qemu command line when using RADOS Block Device (aka RBD), which allows local users to obtain sensitive information via a process listing.
21	CVE-2015-2808	327		2015-04-01	2020-11-23	5.0	None	Remote	Low	Not required	Partial	None	None
The RC4 algorithm, as used in the TLS protocol and SSL protocol, does not properly combine state data with key data during the initialization phase, which makes it easier for remote attackers to conduct plaintext-recovery attacks against the initial bytes of a stream by sniffing network traffic that occasionally relies on keys affected by the Invariance Weakness, and then using a brute-force approach involving LSB values, aka the "Bar Mitzvah" issue.
22	CVE-2015-1779	400	DoS	2016-01-12	2020-09-09	7.8	None	Remote	Low	Not required	None	None	Complete
The VNC websocket frame decoder in QEMU allows remote attackers to cause a denial of service (memory and CPU consumption) via a large (1) websocket payload or (2) HTTP headers section.
23	CVE-2015-0797		DoS Exec Code	2015-05-14	2020-09-28	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
GStreamer before 1.4.5, as used in Mozilla Firefox before 38.0, Firefox ESR 31.x before 31.7, and Thunderbird before 31.7 on Linux, allows remote attackers to cause a denial of service (buffer over-read and application crash) or possibly execute arbitrary code via crafted H.264 video data in an m4v file.
24	CVE-2014-7840	20	Exec Code	2014-12-12	2020-08-11	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The host_from_stream_offset function in arch_init.c in QEMU, when loading RAM during migration, allows remote attackers to execute arbitrary code via a crafted (1) offset or (2) length value in savevm data.
25	CVE-2014-7815	20	DoS	2014-11-14	2020-08-11	5.0	None	Remote	Low	Not required	None	None	Partial
The set_pixel_format function in ui/vnc.c in QEMU allows remote attackers to cause a denial of service (crash) via a small bytes_per_pixel value.
26	CVE-2014-5353	476	DoS	2014-12-16	2021-02-02	3.5	None	Remote	Medium	???	None	None	Partial
The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by using an incorrect object type for a password policy.
27	CVE-2014-4341	125	DoS	2014-07-20	2021-02-02	5.0	None	Remote	Low	Not required	None	None	Partial
MIT Kerberos 5 (aka krb5) before 1.12.2 allows remote attackers to cause a denial of service (buffer over-read and application crash) by injecting invalid tokens into a GSSAPI application session.
28	CVE-2014-3615	200	+Info	2014-11-01	2020-08-11	2.1	None	Local	Low	Not required	Partial	None	None
The VGA emulator in QEMU allows local guest users to read host memory by setting the display to a high resolution.
29	CVE-2014-3469	476	DoS	2014-06-05	2020-11-16	5.0	None	Remote	Low	Not required	None	None	Partial
The (1) asn1_read_value_type and (2) asn1_read_value functions in GNU Libtasn1 before 3.6 allows context-dependent attackers to cause a denial of service (NULL pointer dereference and crash) via a NULL value in an ivalue argument.
30	CVE-2014-3468	131		2014-06-05	2020-11-16	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The asn1_get_bit_der function in GNU Libtasn1 before 3.6 does not properly report an error when a negative bit length is identified, which allows context-dependent attackers to cause out-of-bounds access via crafted ASN.1 data.
31	CVE-2014-3467		DoS	2014-06-05	2020-11-16	5.0	None	Remote	Low	Not required	None	None	Partial
Multiple unspecified vulnerabilities in the DER decoder in GNU Libtasn1 before 3.6, as used in GnuTLS, allow remote attackers to cause a denial of service (out-of-bounds read) via crafted ASN.1 data.
32	CVE-2013-5704		Bypass	2014-04-15	2022-04-14	5.0	None	Remote	Low	Not required	None	Partial	None
The mod_headers module in the Apache HTTP Server 2.2.22 allows remote attackers to bypass "RequestHeader unset" directives by placing a header in the trailer portion of data sent with chunked transfer coding. NOTE: the vendor states "this is not a security issue in httpd as such."

Total number of vulnerabilities : 32 Page : 1 (This Page)