Redhat » Enterprise Linux : Security Vulnerabilities, CVEs, Published In 2016 (Information Leak) CVSS score >= 5
The rds_inc_info_copy function in net/rds/recv.c in the Linux kernel through 4.6.3 does not initialize a certain structure member, which allows remote attackers to obtain sensitive information from kernel stack memory by reading an RDS message.
Max CVSS
7.5
EPSS Score
0.47%
Published
2016-06-27
Updated
2019-04-22
The DES and Triple DES ciphers, as used in the TLS, SSH, and IPSec protocols and other protocols and products, have a birthday bound of approximately four billion blocks, which makes it easier for remote attackers to obtain cleartext data via a birthday attack against a long-duration encrypted session, as demonstrated by an HTTPS session using Triple DES in CBC mode, aka a "Sweet32" attack.
Max CVSS
7.5
EPSS Score
0.53%
Published
2016-09-01
Updated
2023-02-12
libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key exchange methods to 128 bits, which makes it easier for man-in-the-middle attackers to decrypt or intercept SSH sessions via unspecified vectors, aka a "bits/bytes confusion bug."
Max CVSS
5.9
EPSS Score
0.39%
Published
2016-04-13
Updated
2017-12-09
Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and I/O decoding control bits. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-0777.
Max CVSS
6.5
EPSS Score
0.05%
Published
2016-04-13
Updated
2019-08-13
PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in ext/standard/streamsfuncs.c, as demonstrated by a filename\0.extension attack that bypasses an intended configuration in which client users may read files with only one specific extension.
Max CVSS
5.3
EPSS Score
1.43%
Published
2016-05-16
Updated
2019-04-22
5 vulnerabilities found