Extra Packages For Enterprise Linux
CVEs (76)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2022-2294 | Hig | 0.81 | 8.8 | 0.71 | KEV | Jul 28, 2022 | Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | |
| CVE-2023-34152 | Cri | 0.64 | 9.8 | 0.08 | May 30, 2023 | A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured. | ||
| CVE-2022-4170 | Cri | 0.64 | 9.8 | 0.02 | Dec 9, 2022 | The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set. | ||
| CVE-2022-40315 | Cri | 0.64 | 9.8 | 0.01 | Sep 30, 2022 | A limited SQL injection risk was identified in the "browse list of users" site administration page. | ||
| CVE-2022-45152 | Cri | 0.59 | 9.1 | 0.01 | Nov 25, 2022 | A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An… | ||
| CVE-2022-24882 | Cri | 0.59 | 9.1 | 0.03 | Apr 26, 2022 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP… | ||
| CVE-2021-45079 | Cri | 0.59 | 9.1 | 0.03 | Jan 31, 2022 | In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication. | ||
| CVE-2022-2296 | Hig | 0.57 | 8.8 | 0.01 | Jul 28, 2022 | Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via direct UI interactions. | ||
| CVE-2022-2295 | Hig | 0.57 | 8.8 | 0.01 | Jul 28, 2022 | Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2022-2163 | Hig | 0.57 | 8.8 | 0.01 | Jul 28, 2022 | Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction. | ||
| CVE-2022-2158 | Hig | 0.57 | 8.8 | 0.01 | Jul 28, 2022 | Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | ||
| CVE-2021-21897 | Hig | 0.57 | 8.8 | 0.03 | Sep 8, 2021 | A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability. | ||
| CVE-2021-38714 | Hig | 0.57 | 8.8 | 0.03 | Aug 24, 2021 | In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file. | ||
| CVE-2023-34432 | Hig | 0.51 | 7.8 | 0.00 | Jul 10, 2023 | A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure. | ||
| CVE-2023-34318 | Hig | 0.51 | 7.8 | 0.00 | Jul 10, 2023 | A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code execution, or information disclosure. | ||
| CVE-2023-34153 | Hig | 0.51 | 7.8 | 0.03 | May 30, 2023 | A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding. | ||
| CVE-2022-0367 | Hig | 0.51 | 7.8 | 0.00 | Aug 29, 2022 | A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c. | ||
| CVE-2022-32546 | Hig | 0.51 | 7.8 | 0.01 | Jun 16, 2022 | A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to… | ||
| CVE-2022-0546 | Hig | 0.51 | 7.8 | 0.01 | Feb 24, 2022 | A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution. | ||
| CVE-2022-0983 | Hig | 0.50 | 8.8 | 0.01 | Mar 25, 2022 | An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default. |
- risk 0.81cvss 8.8epss 0.71
Heap buffer overflow in WebRTC in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.64cvss 9.8epss 0.08
A vulnerability was found in ImageMagick. This security flaw cause a remote code execution vulnerability in OpenBlob with --enable-pipes configured.
- risk 0.64cvss 9.8epss 0.02
The rxvt-unicode package is vulnerable to a remote code execution, in the Perl background extension, when an attacker can control the data written to the user's terminal and certain options are set.
- risk 0.64cvss 9.8epss 0.01
A limited SQL injection risk was identified in the "browse list of users" site administration page.
- risk 0.59cvss 9.1epss 0.01
A blind Server-Side Request Forgery (SSRF) vulnerability was found in Moodle. This flaw exists due to insufficient validation of user-supplied input in LTI provider library. The library does not utilise Moodle's inbuilt cURL helper, which resulted in a blind SSRF risk. An…
- risk 0.59cvss 9.1epss 0.03
FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not properly abort when someone provides and empty password value. This issue affects FreeRDP based RDP Server implementations. RDP…
- risk 0.59cvss 9.1epss 0.03
In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the case of EAP methods with mutual authentication and EAP-only authentication for IKEv2) even without server authentication.
- risk 0.57cvss 8.8epss 0.01
Use after free in Chrome OS Shell in Google Chrome on Chrome OS prior to 103.0.5060.114 allowed a remote attacker who convinced a user to engage in specific user interactions to potentially exploit heap corruption via direct UI interactions.
- risk 0.57cvss 8.8epss 0.01
Type confusion in V8 in Google Chrome prior to 103.0.5060.114 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.01
Use after free in Cast UI and Toolbar in Google Chrome prior to 103.0.5060.134 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via UI interaction.
- risk 0.57cvss 8.8epss 0.01
Type confusion in V8 in Google Chrome prior to 103.0.5060.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- risk 0.57cvss 8.8epss 0.03
A code execution vulnerability exists in the DL_Dxf::handleLWPolylineData functionality of Ribbonsoft dxflib 3.17.0. A specially-crafted .dxf file can lead to a heap buffer overflow. An attacker can provide a malicious file to trigger this vulnerability.
- risk 0.57cvss 8.8epss 0.03
In Plib through 1.85, there is an integer overflow vulnerability that could result in arbitrary code execution. The vulnerability is found in ssgLoadTGA() function in src/ssg/ssgLoadTGA.cxx file.
- risk 0.51cvss 7.8epss 0.00
A heap buffer overflow vulnerability was found in sox, in the lsx_readbuf function at sox/src/formats_i.c:98:16. This flaw can lead to a denial of service, code execution, or information disclosure.
- risk 0.51cvss 7.8epss 0.00
A heap buffer overflow vulnerability was found in sox, in the startread function at sox/src/hcom.c:160:41. This flaw can lead to a denial of service, code execution, or information disclosure.
- risk 0.51cvss 7.8epss 0.03
A vulnerability was found in ImageMagick. This security flaw causes a shell command injection vulnerability via video:vsync or video:pixel-format options in VIDEO encoding/decoding.
- risk 0.51cvss 7.8epss 0.00
A heap-based buffer overflow flaw was found in libmodbus in function modbus_reply() in src/modbus.c.
- risk 0.51cvss 7.8epss 0.01
A vulnerability was found in ImageMagick, causing an outside the range of representable values of type 'unsigned long' at coders/pcl.c, when crafted or untrusted input is processed. This leads to a negative impact to application availability or other problems related to…
- risk 0.51cvss 7.8epss 0.01
A missing bounds check in the image loader used in Blender 3.x and 2.93.8 leads to out-of-bounds heap access, allowing an attacker to cause denial of service, memory corruption or potentially code execution.
- risk 0.50cvss 8.8epss 0.01
An SQL injection risk was identified in Badges code relating to configuring criteria. Access to the relevant capability was limited to teachers and managers by default.
Page 1 of 4