7 * * * : Security Vulnerabilities

Cpe Name:cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:*

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2016-7166	399	DoS	2016-09-21	2019-12-27	4.3	None	Remote	Medium	Not required	None	None	Partial
libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.
2	CVE-2016-7039	399	DoS	2016-10-16	2019-12-27	7.8	None	Remote	Low	Not required	None	None	Complete
The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.
3	CVE-2016-6302	20	DoS	2016-09-16	2019-12-27	5.0	None	Remote	Low	Not required	None	None	Partial
The tls_decrypt_ticket function in ssl/t1_lib.c in OpenSSL before 1.1.0 does not consider the HMAC size during validation of the ticket length, which allows remote attackers to cause a denial of service via a ticket that is too short.
4	CVE-2016-6250	190	DoS Exec Code Overflow	2016-09-21	2019-12-27	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.
5	CVE-2016-5844	190	DoS Overflow	2016-09-21	2019-12-27	4.3	None	Remote	Medium	Not required	None	None	Partial
Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
6	CVE-2016-5444			2016-07-21	2019-12-27	4.3	None	Remote	Medium	Not required	Partial	None	None
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.11 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Connection.
7	CVE-2016-5440			2016-07-21	2019-12-27	4.0	None	Remote	Low	???	None	None	Partial
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote administrators to affect availability via vectors related to Server: RBR.
8	CVE-2016-5418	20		2016-09-21	2019-12-27	5.0	None	Remote	Low	Not required	None	Partial	None
The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.
9	CVE-2016-5404	284		2016-09-07	2019-12-27	4.0	None	Remote	Low	???	None	None	Partial
The cert_revoke command in FreeIPA does not check for the "revoke certificate" permission, which allows remote authenticated users to revoke arbitrary certificates by leveraging the "retrieve certificate" permission.
10	CVE-2016-5403	400	DoS	2016-08-02	2021-08-04	4.9	None	Local	Low	Not required	None	None	Complete
The virtqueue_pop function in hw/virtio/virtio.c in QEMU allows local guest OS administrators to cause a denial of service (memory consumption and QEMU process crash) by submitting requests without waiting for completion.
11	CVE-2016-5388	284		2016-07-19	2020-08-14	5.1	None	Remote	High	Not required	Partial	Partial	Partial
Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "A mitigation is planned for future releases of Tomcat, tracked as CVE-2016-5388"; in other words, this is not a CVE ID for a vulnerability.
12	CVE-2016-5387	284		2016-07-19	2021-06-06	5.1	None	Remote	High	Not required	Partial	Partial	Partial
The Apache HTTP Server through 2.4.23 follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect an application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. NOTE: the vendor states "This mitigation has been assigned the identifier CVE-2016-5387"; in other words, this is not a CVE ID for a vulnerability.
13	CVE-2016-5386	284		2016-07-19	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The net/http package in Go through 1.6 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue.
14	CVE-2016-5265	79	XSS Bypass	2016-08-05	2019-12-27	4.0	None	Remote	High	Not required	Partial	Partial	None
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and conduct Universal XSS (UXSS) attacks or read arbitrary files, by arranging for the presence of a crafted HTML document and a crafted shortcut file in the same local directory.
15	CVE-2016-5264	416	DoS Exec Code Mem. Corr.	2016-08-05	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code or cause a denial of service (heap memory corruption) via an SVG element that is mishandled during effect application.
16	CVE-2016-5263	704	Exec Code	2016-08-05	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformation, which allows remote attackers to execute arbitrary code via a crafted web site that leverages "type confusion."
17	CVE-2016-5262	79	XSS	2016-08-05	2019-12-27	4.3	None	Remote	Medium	Not required	None	Partial	None
Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandboxed IFRAME element that lacks the sandbox="allow-scripts" attribute value, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site.
18	CVE-2016-5259	416	Exec Code	2016-08-05	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via a script that closes its own Service Worker within a nested sync event loop.
19	CVE-2016-5258	416	Exec Code	2016-08-05	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code by leveraging incorrect free operations on DTLS objects during the shutdown of a WebRTC session.
20	CVE-2016-5254	416	DoS Exec Code Mem. Corr.	2016-08-05	2019-12-27	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service (heap memory corruption and application crash) by leveraging keyboard access to use the Alt key during selection of top-level menu items.
21	CVE-2016-5252	119	Exec Code Overflow	2016-08-05	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attackers to execute arbitrary code via crafted two-dimensional graphics data that is mishandled during clipping-region calculations.
22	CVE-2016-5118	284	Exec Code	2016-06-10	2019-12-27	10.0	None	Remote	Low	Not required	Complete	Complete	Complete
The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a \| (pipe) character at the start of a filename.
23	CVE-2016-4998	119	DoS Overflow +Info	2016-07-03	2019-12-27	5.6	None	Local	Low	Not required	Partial	None	Complete
The IPT_SO_SET_REPLACE setsockopt implementation in the netfilter subsystem in the Linux kernel before 4.6 allows local users to cause a denial of service (out-of-bounds read) or possibly obtain sensitive information from kernel heap memory by leveraging in-container root access to provide a crafted offset value that leads to crossing a ruleset blob boundary.
24	CVE-2016-4997	264	DoS +Priv Mem. Corr.	2016-07-03	2019-12-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The compat IPT_SO_SET_REPLACE and IP6T_SO_SET_REPLACE setsockopt implementations in the netfilter subsystem in the Linux kernel before 4.6.3 allow local users to gain privileges or cause a denial of service (memory corruption) by leveraging in-container root access to provide a crafted offset value that triggers an unintended decrement.
25	CVE-2016-4809	20	DoS	2016-09-21	2019-12-27	5.0	None	Remote	Low	Not required	None	None	Partial
The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.
26	CVE-2016-4556		DoS	2016-05-10	2019-12-27	5.0	None	Remote	Low	Not required	None	None	Partial
Double free vulnerability in Esi.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via a crafted Edge Side Includes (ESI) response.
27	CVE-2016-4555	20	DoS	2016-05-10	2019-12-27	5.0	None	Remote	Low	Not required	None	None	Partial
client_side_request.cc in Squid 3.x before 3.5.18 and 4.x before 4.0.10 allows remote servers to cause a denial of service (crash) via crafted Edge Side Includes (ESI) responses.
28	CVE-2016-4554	345	Bypass	2016-05-10	2019-12-27	5.0	None	Remote	Low	Not required	None	Partial	None
mime_header.cc in Squid before 3.5.18 allows remote attackers to bypass intended same-origin restrictions and possibly conduct cache-poisoning attacks via a crafted HTTP Host header, aka a "header smuggling" issue.
29	CVE-2016-4553	345		2016-05-10	2019-12-27	5.0	None	Remote	Low	Not required	None	Partial	None
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
30	CVE-2016-4470		DoS	2016-06-27	2019-12-27	4.9	None	Local	Low	Not required	None	None	Complete
The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.
31	CVE-2016-4054	119	Exec Code Overflow	2016-04-25	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
32	CVE-2016-4053	119	Overflow +Info	2016-04-25	2019-12-27	4.3	None	Remote	Medium	Not required	Partial	None	None
Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses, related to incorrect use of assert and compiler optimization.
33	CVE-2016-4051	119	DoS Exec Code Overflow	2016-04-25	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbitrary code by seeding manager reports with crafted data.
34	CVE-2016-3615			2016-07-21	2019-12-27	4.3	None	Remote	Medium	Not required	None	None	Partial
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: DML.
35	CVE-2016-3610			2016-07-21	2022-05-13	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3598.
36	CVE-2016-3598			2016-07-21	2022-05-13	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Libraries, a different vulnerability than CVE-2016-3610.
37	CVE-2016-3587			2016-07-21	2022-05-13	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Unspecified vulnerability in Oracle Java SE 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Hotspot.
38	CVE-2016-3550			2016-07-21	2022-05-13	4.3	None	Remote	Medium	Not required	Partial	None	None
Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92 and Java SE Embedded 8u91 allows remote attackers to affect confidentiality via vectors related to Hotspot.
39	CVE-2016-3521			2016-07-21	2019-12-27	6.8	None	Remote	Low	???	None	None	Complete
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows remote authenticated users to affect availability via vectors related to Server: Types.
40	CVE-2016-3508			2016-07-21	2022-05-13	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3500.
41	CVE-2016-3500			2016-07-21	2022-05-13	5.0	None	Remote	Low	Not required	None	None	Partial
Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; Java SE Embedded 8u91; and JRockit R28.3.10 allows remote attackers to affect availability via vectors related to JAXP, a different vulnerability than CVE-2016-3508.
42	CVE-2016-3477			2016-07-21	2019-12-27	4.1	None	Local	Medium	???	Partial	Partial	Partial
Unspecified vulnerability in Oracle MySQL 5.5.49 and earlier, 5.6.30 and earlier, and 5.7.12 and earlier and MariaDB before 5.5.50, 10.0.x before 10.0.26, and 10.1.x before 10.1.15 allows local users to affect confidentiality, integrity, and availability via vectors related to Server: Parser.
43	CVE-2016-3458			2016-07-21	2022-05-13	4.3	None	Remote	Medium	Not required	None	Partial	None
Unspecified vulnerability in Oracle Java SE 6u115, 7u101, and 8u92; and Java SE Embedded 8u91 allows remote attackers to affect integrity via vectors related to CORBA.
44	CVE-2016-3452			2016-07-21	2019-12-27	4.3	None	Remote	Medium	Not required	Partial	None	None
Unspecified vulnerability in Oracle MySQL 5.5.48 and earlier, 5.6.29 and earlier, and 5.7.10 and earlier and MariaDB before 5.5.49, 10.0.x before 10.0.25, and 10.1.x before 10.1.14 allows remote attackers to affect confidentiality via vectors related to Server: Security: Encryption.
45	CVE-2016-2837	119	Exec Code Overflow Bypass	2016-08-05	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 might allow remote attackers to execute arbitrary code by providing a malformed video and leveraging a Gecko Media Plugin (GMP) sandbox bypass.
46	CVE-2016-2802	119	DoS Overflow	2016-03-13	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The graphite2::TtfUtil::CmapSubtable4NextCodepoint function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.
47	CVE-2016-2801	119	DoS Overflow	2016-03-13	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The graphite2::TtfUtil::CmapSubtable12Lookup function in TtfUtil.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2797.
48	CVE-2016-2800	119	DoS Overflow	2016-03-13	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The graphite2::Slot::getAttr function in Slot.cpp in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font, a different vulnerability than CVE-2016-2792.
49	CVE-2016-2799	119	DoS Overflow	2016-03-13	2019-12-27	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Heap-based buffer overflow in the graphite2::Slot::setAttr function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted Graphite smart font.
50	CVE-2016-2798	119	DoS Overflow	2016-03-13	2019-12-27	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
The graphite2::GlyphCache::Loader::Loader function in Graphite 2 before 1.3.6, as used in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7, allows remote attackers to cause a denial of service (buffer over-read) or possibly have unspecified other impact via a crafted Graphite smart font.

Total number of vulnerabilities : 142 Page : 1 (This Page)2 3