VYPR

Enterprise Linux Hpc Node

by Red Hat

CVEs (146)

  • CVE-2016-4470MedJun 27, 2016
    Linux
    Kernel
    risk 0.36cvss 5.5epss 0.01

    The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.

  • CVE-2015-3412MedMay 16, 2016
    PHP
    PHP
    risk 0.35cvss 5.3epss 0.04

    PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 does not ensure that pathnames lack %00 sequences, which might allow remote attackers to read arbitrary files via crafted input to an application that calls the stream_resolve_include_path function in…

  • CVE-2016-7091MedDec 22, 2016
    Sudo Project
    Sudo
    risk 0.29cvss 4.4epss 0.00

    sudo: It was discovered that the default sudo configuration on Red Hat Enterprise Linux and possibly other Linux implementations preserves the value of INPUTRC which could lead to information disclosure. A local user with sudo access to a restricted program that uses readline…

  • CVE-2016-3716LowMay 5, 2016
    ImageMagick
    Imagemagick
    risk 0.25cvss 3.3epss 0.11

    The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.

  • CVE-2016-4455LowApr 14, 2017
    Candlepinproject
    subscription-manager
    risk 0.21cvss 3.3epss 0.00

    The Subscription Manager package (aka subscription-manager) before 1.17.7-1 for Candlepin uses weak permissions (755) for subscription-manager cache directories, which allows local users to obtain sensitive information by reading files in the directories.

  • CVE-2015-4148Jun 9, 2015
    PHP
    PHP
    risk 0.05cvss —epss 0.20

    The do_soap_call function in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that the uri property is a string, which allows remote attackers to obtain sensitive information by providing crafted serialized data with an int data…

  • CVE-2015-4024Jun 9, 2015
    PHP
    PHP
    risk 0.04cvss —epss 0.50

    Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a denial of service (CPU consumption) via crafted form data that triggers an…

  • CVE-2015-3329Jun 9, 2015
    PHP
    PHP
    risk 0.03cvss —epss 0.38

    Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary code via a crafted length value in a (1) tar, (2) phar, or (3) ZIP archive.

  • CVE-2015-4026Jun 9, 2015
    PHP
    PHP
    risk 0.02cvss —epss 0.20

    The pcntl_exec implementation in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character, which might allow remote attackers to bypass intended extension restrictions and execute files with unexpected names via a…

  • CVE-2015-4025Jun 9, 2015
    PHP
    PHP
    risk 0.02cvss —epss 0.20

    PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 truncates a pathname upon encountering a \x00 character in certain situations, which allows remote attackers to bypass intended extension restrictions and access files or directories with unexpected names via a…

  • CVE-2015-4022Jun 9, 2015
    PHP
    PHP
    risk 0.02cvss —epss 0.21

    Integer overflow in the ftp_genlist function in ext/ftp/ftp.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote FTP servers to execute arbitrary code via a long reply to a LIST command, leading to a heap-based buffer overflow.

  • CVE-2015-4021Jun 9, 2015
    PHP
    PHP
    risk 0.02cvss —epss 0.21

    The phar_parse_tarfile function in ext/phar/tar.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 does not verify that the first character of a filename is different from the \0 character, which allows remote attackers to cause a denial of service (integer…

  • CVE-2016-0505Jan 21, 2016
    MariaDB
    MariaDB
    risk 0.01cvss —epss 0.08

    Unspecified vulnerability in Oracle MySQL 5.5.46 and earlier, 5.6.27 and earlier, and 5.7.9 and MariaDB before 5.5.47, 10.0.x before 10.0.23, and 10.1.x before 10.1.10 allows remote authenticated users to affect availability via unknown vectors related to Options.

  • CVE-2015-8327Dec 17, 2015
    Linux Foundation
    Foomatic Filters
    risk 0.01cvss —epss 0.10

    Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attackers to execute arbitrary commands via ` (backtick) characters in a print job.

  • CVE-2015-7499Dec 15, 2015
    Xmlsoft
    Libxml2
    risk 0.01cvss —epss 0.06

    Heap-based buffer overflow in the xmlGROW function in parser.c in libxml2 before 2.9.3 allows context-dependent attackers to obtain sensitive process memory information via unspecified vectors.

  • CVE-2015-7981Nov 24, 2015
    Libpng
    Libpng
    risk 0.01cvss —epss 0.06

    The png_convert_to_rfc1123 function in png.c in libpng 1.0.x before 1.0.64, 1.2.x before 1.2.54, and 1.4.x before 1.4.17 allows remote attackers to obtain sensitive process memory information via crafted tIME chunk data in an image file, which triggers an out-of-bounds read.

  • CVE-2015-4147Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.12

    The SoapClient::__call method in ext/soap/soap.c in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 does not verify that __default_headers is an array, which allows remote attackers to execute arbitrary code by providing crafted serialized data with an unexpected…

  • CVE-2015-3330Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.14

    The php_handler function in sapi/apache2handler/sapi_apache2.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8, when the Apache HTTP Server 2.4.x is used, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…

  • CVE-2015-3307Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.08

    The phar_parse_metadata function in ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to cause a denial of service (heap metadata corruption) or possibly have unspecified other impact via a crafted tar archive.

  • CVE-2015-2783Jun 9, 2015
    PHP
    PHP
    risk 0.01cvss —epss 0.11

    ext/phar/phar.c in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allows remote attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read and application crash) via a crafted length value in conjunction with…

Page 4 of 8