Red Hat Enterprise Linux For IBM Z Systems Eus s390x vulnerabilities

7 CVEs affecting Red Hat Enterprise Linux For IBM Z Systems Eus s390x, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-4911, published 2023-10-03.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2023-4911: GNU C Library Buffer Overflow Vulnerability, published 2023-10-03. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2023-11-21. EPSS: 63.8% chance of exploitation in the next 30 days. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously…
CVE-2023-4813, published 2023-09-12. Medium severity, CVSS 5.9. EPSS: 2.2% chance of exploitation in the next 30 days. A flaw has been identified in glibc. In an uncommon situation, the gaih_inet function may use memory that has been freed, resulting in an application crash. This issue is only exploitable when the…
CVE-2023-4527, published 2023-09-18. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger…
CVE-2023-4806, published 2023-09-18. Medium severity, CVSS 5.9. EPSS: 1.6% chance of exploitation in the next 30 days. A flaw has been identified in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable…
CVE-2019-15718, published 2019-09-04. Medium severity, CVSS 4.4. EPSS: 0.5% chance of exploitation in the next 30 days. In systemd 240, bus_open_system_watch_bind_with_description in shared/bus-util.c (as used by systemd-resolved to connect to the system D-Bus instance), calls sd_bus_set_trusted, which disables access…
CVE-2021-3609, published 2022-03-03. High severity, CVSS 7.0. EPSS: 0.4% chance of exploitation in the next 30 days. .A flaw was found in the CAN BCM networking protocol in the Linux kernel, where a local attacker can abuse a flaw in the CAN subsystem to corrupt memory, crash the system or escalate privileges. This…