Redhat » Enterprise Linux : Security Vulnerabilities

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : Cve Number Descending Cve Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	# of Exploits	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complex ity	Authen tication	Confiden tiality	Integrity	Availa bility
1	CVE-2011-1576	119		DoS Overflow Mem. Corr.	2011-08-31	2012-03-22	5.7	None	Local Network	Medium	Not required	None	None	Complete
The Generic Receive Offload (GRO) implementation in the Linux kernel 2.6.18 on Red Hat Enterprise Linux 5 and 2.6.32 on Red Hat Enterprise Linux 6, as used in Red Hat Enterprise Virtualization (RHEV) Hypervisor and other products, allows remote attackers to cause a denial of service via crafted VLAN packets that are processed by the napi_reuse_skb function, leading to (1) a memory leak or (2) memory corruption, a different vulnerability than CVE-2011-1478.
2	CVE-2011-1011	264		DoS +Priv	2011-02-24	2011-09-06	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The seunshare_mount function in sandbox/seunshare.c in seunshare in certain Red Hat packages of policycoreutils 2.0.83 and earlier in Red Hat Enterprise Linux (RHEL) 6 and earlier, and Fedora 14 and earlier, mounts a new directory on top of /tmp without assigning root ownership and the sticky bit to this new directory, which allows local users to replace or delete arbitrary /tmp files, and consequently cause a denial of service or possibly gain privileges, by running a setuid application that relies on /tmp, as demonstrated by the ksu application.
3	CVE-2011-0714	399		DoS	2011-05-04	2012-03-19	5.7	None	Local Network	Medium	Not required	None	None	Complete
Use-after-free vulnerability in a certain Red Hat patch for the RPC server sockets functionality in the Linux kernel 2.6.32 on Red Hat Enterprise Linux (RHEL) 6 might allow remote attackers to cause a denial of service (crash) via malformed data in a packet, related to lockd and the svc_xprt_received function.
4	CVE-2011-0536			+Priv	2011-04-08	2012-01-26	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
Multiple untrusted search path vulnerabilities in elf/dl-object.c in certain modified versions of the GNU C Library (aka glibc or libc6), including glibc-2.5-49.el5_5.6 and glibc-2.12-1.7.el6_0.3 in Red Hat Enterprise Linux, allow local users to gain privileges via a crafted dynamic shared object (DSO) in a subdirectory of the current working directory during execution of a (1) setuid or (2) setgid program that has $ORIGIN in (a) RPATH or (b) RUNPATH within the program itself or a referenced library. NOTE: this issue exists because of an incorrect fix for CVE-2010-3847.
5	CVE-2010-4161	399		DoS	2010-12-30	2011-10-25	4.9	None	Local	Low	Not required	None	None	Complete
The udp_queue_rcv_skb function in net/ipv4/udp.c in a certain Red Hat build of the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows attackers to cause a denial of service (deadlock and system hang) by sending UDP traffic to a socket that has a crafted socket filter, a related issue to CVE-2010-4158.
6	CVE-2010-2598	20		DoS	2010-07-02	2010-10-12	4.3	None	Remote	Medium	Not required	None	None	Partial
LibTIFF in Red Hat Enterprise Linux (RHEL) 3 on x86_64 platforms, as used in tiff2rgba, attempts to process image data even when the required compression functionality is not configured, which allows remote attackers to cause a denial of service via a crafted TIFF image, related to "downsampled OJPEG input."
7	CVE-2010-0730	20		DoS	2010-05-12	2012-03-19	2.6	None	Remote	High	Not required	None	None	Partial
The MMIO instruction decoder in the Xen hypervisor in the Linux kernel 2.6.18 in Red Hat Enterprise Linux (RHEL) 5 allows guest OS users to cause a denial of service (32-bit guest OS crash) via vectors that trigger an unspecified instruction emulation.
8	CVE-2010-0729	264		+Priv	2010-03-16	2010-08-21	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process, and consequently gain privileges, via vectors related to a missing ptrace_check_attach call.
9	CVE-2010-0727	399		DoS	2010-03-16	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
The gfs2_lock function in the Linux kernel before 2.6.34-rc1-next-20100312, and the gfs_lock function in the Linux kernel on Red Hat Enterprise Linux (RHEL) 5 and 6, does not properly remove POSIX locks on files that are setgid without group-execute permission, which allows local users to cause a denial of service (BUG and system crash) by locking a file on a (1) GFS or (2) GFS2 filesystem, and then changing this file's permissions.
10	CVE-2009-4272	20		DoS	2010-01-27	2012-03-19	7.8	None	Remote	Low	Not required	None	None	Complete
A certain Red Hat patch for net/ipv4/route.c in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5 allows remote attackers to cause a denial of service (deadlock) via crafted packets that force collisions in the IPv4 routing hash table, and trigger a routing "emergency" in which a hash chain is too long. NOTE: this is related to an issue in the Linux kernel before 2.6.31, when the kernel routing cache is disabled, involving an uninitialized pointer and a panic.
11	CVE-2009-3556	264			2010-01-27	2012-03-19	1.9	None	Local	Medium	Not required	None	Partial	None
A certain Red Hat configuration step for the qla2xxx driver in the Linux kernel 2.6.18 on Red Hat Enterprise Linux (RHEL) 5, when N_Port ID Virtualization (NPIV) hardware is used, sets world-writable permissions for the (1) vport_create and (2) vport_delete files under /sys/class/scsi_host/, which allows local users to make arbitrary changes to SCSI host attributes by modifying these files.
12	CVE-2009-1893	59			2009-07-17	2010-08-21	6.9	None	Local	Medium	Not required	Complete	Complete	Complete
The configtest function in the Red Hat dhcpd init script for DHCP 3.0.1 in Red Hat Enterprise Linux (RHEL) 3 allows local users to overwrite arbitrary files via a symlink attack on an unspecified temporary file, related to the "dhcpd -t" command.
13	CVE-2009-1887	189		DoS	2009-06-26	2010-08-21	5.0	None	Remote	Low	Not required	None	None	Partial
agent/snmp_agent.c in snmpd in net-snmp 5.0.9 in Red Hat Enterprise Linux (RHEL) 3 allows remote attackers to cause a denial of service (daemon crash) via a crafted SNMP GETBULK request that triggers a divide-by-zero error. NOTE: this vulnerability exists because of an incorrect fix for CVE-2008-4309.
14	CVE-2008-4315				2008-11-26	2010-08-21	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
tog-pegasus in OpenGroup Pegasus 2.7.0 on Red Hat Enterprise Linux (RHEL) 5, Fedora 9, and Fedora 10 does not log failed authentication attempts to the OpenPegasus CIM server, which makes it easier for remote attackers to avoid detection of password guessing attacks.
15	CVE-2008-4313	264		Bypass	2008-11-26	2010-08-21	6.0	None	Remote	Medium	Single system	Partial	Partial	Partial
A certain Red Hat patch for tog-pegasus in OpenGroup Pegasus 2.7.0 does not properly configure the PAM tty name, which allows remote authenticated users to bypass intended access restrictions and send requests to OpenPegasus WBEM services.
16	CVE-2008-3825	264		+Priv	2008-10-03	2011-02-17	4.4	User	Local	Medium	Not required	Partial	Partial	Partial
pam_krb5 2.2.14 in Red Hat Enterprise Linux (RHEL) 5 and earlier, when the existing_ticket option is enabled, uses incorrect privileges when reading a Kerberos credential cache, which allows local users to gain privileges by setting the KRB5CCNAME environment variable to an arbitrary cache filename and running the (1) su or (2) sudo program. NOTE: there may be a related vector involving sshd that has limited relevance.
17	CVE-2008-3270	310		DoS	2008-08-18	2010-08-21	2.6	None	Remote	High	Not required	None	Partial	None
yum-rhn-plugin in Red Hat Enterprise Linux (RHEL) 5 does not verify the SSL certificate for a file download from a Red Hat Network (RHN) server, which makes it easier for remote man-in-the-middle attackers to cause a denial of service (loss of updates) or force the download and installation of official Red Hat packages that were not requested.
18	CVE-2008-2365	362		DoS	2008-06-30	2012-03-19	4.7	None	Local	Medium	Not required	None	None	Complete
Race condition in the ptrace and utrace support in the Linux kernel 2.6.9 through 2.6.25, as used in Red Hat Enterprise Linux (RHEL) 4, allows local users to cause a denial of service (oops) via a long series of PTRACE_ATTACH ptrace calls to another user's process that trigger a conflict between utrace_detach and report_quiescent, related to "late ptrace_may_attach() check" and "race around &dead_engine_ops setting," a different vulnerability than CVE-2007-0771 and CVE-2008-1514. NOTE: this issue might only affect kernel versions before 2.6.16.x.
19	CVE-2008-1951	264		+Priv	2008-06-25	2010-08-21	4.6	User	Local	Low	Not required	Partial	Partial	Partial
Untrusted search path vulnerability in a certain Red Hat build script for Standards Based Linux Instrumentation for Manageability (sblim) libraries before 1-13a.el4_6.1 in Red Hat Enterprise Linux (RHEL) 4, and before 1-31.el5_2.1 in RHEL 5, allows local users to gain privileges via a malicious library in a certain subdirectory of /var/tmp, related to an incorrect RPATH setting, as demonstrated by a malicious libc.so library for tog-pegasus.
20	CVE-2008-1767	119		DoS Exec Code Overflow	2008-05-23	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in pattern.c in libxslt before 1.1.24 allows context-dependent attackers to cause a denial of service (crash) and possibly execute arbitrary code via an XSL style sheet file with a long XSLT "transformation match" condition that triggers a large number of steps.
21	CVE-2008-1615	399		DoS	2008-05-07	2010-08-21	4.9	None	Local	Low	Not required	None	None	Complete
Linux kernel 2.6.18, and possibly other versions, when running on AMD64 architectures, allows local users to cause a denial of service (crash) via certain ptrace calls.
22	CVE-2008-1198	16			2008-03-06	2008-09-05	7.1	None	Remote	Medium	Not required	Complete	None	None
The default IPSec ifup script in Red Hat Enterprise Linux 3 through 5 configures racoon to use aggressive IKE mode instead of main IKE mode, which makes it easier for remote attackers to conduct brute force attacks by sniffing an unencrypted preshared key (PSK) hash.
23	CVE-2008-1036	79		XSS	2008-06-02	2011-10-11	4.3	None	Remote	Medium	Not required	None	Partial	None
The International Components for Unicode (ICU) library in Apple Mac OS X before 10.5.3, Red Hat Enterprise Linux 5, and other operating systems omits some invalid character sequences during conversion of some character encodings, which might allow remote attackers to conduct cross-site scripting (XSS) attacks.
24	CVE-2007-6285	16			2007-12-20	2010-11-16	6.2	Admin	Local	High	Not required	Complete	Complete	Complete
The default configuration for autofs 5 (autofs5) in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 4 and 5, does not specify the nodev mount option for the -hosts map, which allows local users to access "important devices" by operating a remote NFS server and creating special device files on that server, as demonstrated by the /dev/mem device.
25	CVE-2007-6283	200		DoS +Info	2007-12-17	2010-08-21	4.9	None	Local	Low	Not required	None	None	Complete
Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file with world-readable permissions, which allows local users to perform unauthorized named commands, such as causing a denial of service by stopping named.
26	CVE-2007-6282	16		DoS	2008-05-07	2010-08-21	7.1	None	Remote	Medium	Not required	None	None	Complete
The IPsec implementation in Linux kernel before 2.6.25 allows remote routers to cause a denial of service (crash) via a fragmented ESP packet in which the first fragment does not contain the entire ESP header and IV.
27	CVE-2007-5964	16		+Priv	2007-12-13	2010-08-21	6.9	Admin	Local	Medium	Not required	Complete	Complete	Complete
The default configuration of autofs 5 in some Linux distributions, such as Red Hat Enterprise Linux (RHEL) 5, omits the nosuid option for the hosts (/net filesystem) map, which allows local users to gain privileges via a setuid program on a remote NFS server.
28	CVE-2007-5962	399	1	DoS	2008-05-22	2010-08-21	7.1	None	Remote	Medium	Not required	None	None	Complete
Memory leak in a certain Red Hat patch, applied to vsftpd 2.0.5 on Red Hat Enterprise Linux (RHEL) 5 and Fedora 6 through 8, and on Foresight Linux and rPath appliances, allows remote attackers to cause a denial of service (memory consumption) via a large number of CWD commands, as demonstrated by an attack on a daemon with the deny_file configuration option.
29	CVE-2007-5494	399		DoS	2007-11-29	2010-08-21	4.9	None	Local	Low	Not required	None	None	Complete
Memory leak in the Red Hat Content Accelerator kernel patch in Red Hat Enterprise Linux (RHEL) 4 and 5 allows local users to cause a denial of service (memory consumption) via a large number of open requests involving O_ATOMICLOOKUP.
30	CVE-2007-5365	119	1	DoS Exec Code Overflow	2007-10-11	2011-08-02	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Stack-based buffer overflow in the cons_options function in options.c in dhcpd in OpenBSD 4.0 through 4.2, and some other dhcpd implementations based on ISC dhcp-2, allows remote attackers to execute arbitrary code or cause a denial of service (daemon crash) via a DHCP request specifying a maximum message size smaller than the minimum IP MTU.
31	CVE-2007-5116	119		Exec Code Overflow	2007-11-07	2010-08-21	7.5	User	Remote	Low	Not required	Partial	Partial	Partial
Buffer overflow in the polymorphic opcode support in the Regular Expression Engine (regcomp.c) in Perl 5.8 allows context-dependent attackers to execute arbitrary code by switching from byte to Unicode (UTF) characters in a regular expression.
32	CVE-2007-5001	399		DoS	2008-05-07	2010-08-21	4.9	None	Local	Low	Not required	None	None	Complete
Linux kernel before 2.4.21 allows local users to cause a denial of service (kernel panic) via asynchronous input or output on a FIFO special file.
33	CVE-2007-4574			DoS	2007-10-23	2010-08-21	4.7	None	Local	Medium	Not required	None	None	Complete
Unspecified vulnerability in the "stack unwinder fixes" in kernel in Red Hat Enterprise Linux 5, when running on AMD64 and Intel 64, allows local users to cause a denial of service via unknown vectors.
34	CVE-2007-4130	20		DoS	2008-02-04	2010-08-21	7.2	None	Local	Low	Not required	Complete	Complete	Complete
The Linux kernel 2.6.9 before 2.6.9-67 in Red Hat Enterprise Linux (RHEL) 4 on Itanium (ia64) does not properly handle page faults during NUMA memory access, which allows local users to cause a denial of service (panic) via invalid arguments to set_mempolicy in an MPOL_BIND operation.
35	CVE-2007-3849	264		Bypass	2007-09-04	2010-08-21	1.9	None	Local	Medium	Not required	None	Partial	None
Red Hat Enterprise Linux (RHEL) 5 ships the rpm for the Advanced Intrusion Detection Environment (AIDE) before 0.13.1 with a database that lacks checksum information, which allows context-dependent attackers to bypass file integrity checks and modify certain files.
36	CVE-2007-3739	399		DoS	2007-09-13	2010-08-21	4.7	None	Local	Medium	Not required	None	None	Complete
mm/mmap.c in the hugetlb kernel, when run on PowerPC systems, does not prevent stack expansion from entering into reserved kernel page memory, which allows local users to cause a denial of service (OOPS) via unspecified vectors.
37	CVE-2007-3379			DoS	2007-09-17	2010-08-21	2.1	None	Local	Low	Not required	None	None	Partial
Unspecified vulnerability in the kernel in Red Hat Enterprise Linux (RHEL) 4 on the x86_64 platform allows local users to cause a denial of service (OOPS) via unspecified vectors related to the get_gate_vma function and the fuser command.
38	CVE-2007-3103	59	1		2007-07-15	2010-08-21	6.2	Admin	Local	High	Not required	Complete	Complete	Complete
The init.d script for the X.Org X11 xfs font server on various Linux distributions might allow local users to change the permissions of arbitrary files via a symlink attack on the /tmp/.font-unix temporary file.
39	CVE-2007-3099			DoS	2007-06-14	2010-08-21	2.1	None	Local	Low	Not required	None	None	Partial
usr/mgmt_ipc.c in iscsid in open-iscsi (iscsi-initiator-utils) before 2.0-865 checks the client's UID on the listening AF_LOCAL socket instead of the new connection, which allows remote attackers to access the management interface and cause a denial of service (iscsid exit or iSCSI connection loss).
40	CVE-2007-2834	189		Exec Code Overflow	2007-09-18	2011-10-11	9.3	Admin	Remote	Medium	Not required	Complete	Complete	Complete
Integer overflow in the TIFF parser in OpenOffice.org (OOo) before 2.3; and Sun StarOffice 6, 7, and 8 Office Suite (StarSuite); allows remote attackers to execute arbitrary code via a TIFF file with crafted values of unspecified length fields, which triggers allocation of an incorrect amount of memory, resulting in a heap-based buffer overflow.
41	CVE-2007-2030				2007-04-16	2008-11-13	4.9	None	Local	Low	Not required	Complete	None	None
lharc.c in lha does not securely create temporary files, which might allow local users to read or write files by creating a file before LHA is invoked.
42	CVE-2007-1865	189		+Info	2007-09-18	2008-11-13	1.9	None	Local	Medium	Not required	Partial	None	None
DISPUTED The ipv6_getsockopt_sticky function in the kernel in Red Hat Enterprise Linux (RHEL) Beta 5.1.0 allows local users to obtain sensitive information (kernel memory contents) via a negative value of the len parameter. NOTE: this issue has been disputed in a bug comment, stating that "len is ignored when copying header info to the user's buffer."
43	CVE-2007-1716			+Priv	2007-03-27	2010-08-21	3.4	User	Local	High	Multiple systems	Partial	Partial	Partial
pam_console does not properly restore ownership for certain console devices when there are multiple users logged into the console and one user logs out, which might allow local users to gain privileges.
44	CVE-2007-1352			Exec Code Overflow	2007-04-05	2010-11-30	3.8	None	Local Network	Medium	Single system	None	Partial	Partial
Integer overflow in the FontFileInitTable function in X.Org libXfont before 20070403 allows remote authenticated users to execute arbitrary code via a long first line in the fonts.dir file, which results in a heap overflow.
45	CVE-2007-1351	189		Exec Code Overflow	2007-04-05	2010-11-30	8.5	Admin	Remote	Medium	Single system	Complete	Complete	Complete
Integer overflow in the bdfReadCharacters function in bdfread.c in (1) X.Org libXfont before 20070403 and (2) freetype 2.3.2 and earlier allows remote authenticated users to execute arbitrary code via crafted BDF fonts, which result in a heap overflow.
46	CVE-2007-1007			DoS Exec Code	2007-02-20	2010-09-15	10.0	Admin	Remote	Low	Not required	Complete	Complete	Complete
Format string vulnerability in GnomeMeeting 1.0.2 and earlier allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via format strings in the name, which is not properly handled in a call to the gnomemeeting_log_insert function.
47	CVE-2007-0773			DoS	2007-06-26	2010-08-21	4.6	None	Local	Low	Single system	None	None	Complete
The Linux kernel before 2.6.9-42.0.8 in Red Hat 4.4 allows local users to cause a denial of service (kernel OOPS from null dereference) via fput in a 32-bit ioctl on 64-bit x86 systems, an incomplete fix of CVE-2005-3044.1.
48	CVE-2007-0771			DoS	2007-05-02	2012-03-26	4.9	None	Local	Low	Not required	None	None	Complete
The utrace support in Linux kernel 2.6.18, and other versions, allows local users to cause a denial of service (system hang) related to "MT exec + utrace_attach spin failure mode," as demonstrated by ptrace-thrash.c.
49	CVE-2007-0004	264		+Info	2007-09-18	2008-09-05	1.9	None	Local	Medium	Not required	Partial	None	None
The NFS client implementation in the kernel in Red Hat Enterprise Linux (RHEL) 3, when a filesystem is mounted with the noacl option, checks permissions for the open system call via vfs_permission (mode bits) data rather than an NFS ACCESS call to the server, which allows local client processes to obtain a false success status from open calls that the server would deny, and possibly obtain sensitive information about file permissions on the server, as demonstrated in a root_squash environment. NOTE: it is uncertain whether any scenarios involving this issue cross privilege boundaries.
50	CVE-2007-0001			DoS	2007-03-02	2010-08-21	4.7	None	Local	Medium	Not required	None	None	Complete
The file watch implementation in the audit subsystem (auditctl -w) in the Red Hat Enterprise Linux (RHEL) 4 kernel 2.6.9 allows local users to cause a denial of service (kernel panic) by replacing a watched file, which does not cause the watch on the old inode to be dropped.

Total number of vulnerabilities : 172 Page : 1 (This Page)2 3 4