Red Hat Enterprise Linux For Power Big Endian vulnerabilities

45 CVEs affecting Red Hat Enterprise Linux For Power Big Endian, 15 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-1086, published 2024-01-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2014-6271: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-24. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 100% chance of exploitation in the next 30 days. GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment,…
CVE-2021-40438: Apache HTTP Server-Side Request Forgery (SSRF), published 2021-09-16. Critical severity, CVSS 9.0. Actively exploited: in CISA KEV since 2021-12-01. EPSS: 100% chance of exploitation in the next 30 days. A crafted request uri-path can cause mod_proxy to forward the request to an origin server choosen by the remote user. This issue affects Apache HTTP Server 2.4.48 and earlier.
CVE-2017-12617: Apache Tomcat Remote Code Execution Vulnerability, published 2017-10-04. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 100% chance of exploitation in the next 30 days. When running Apache Tomcat versions 9.0.0.M1 to 9.0.0, 8.5.0 to 8.5.22, 8.0.0.RC1 to 8.0.46 and 7.0.0 to 7.0.81 with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the…
CVE-2014-7169: GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability, published 2014-09-25. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-01-28. EPSS: 99.9% chance of exploitation in the next 30 days. GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or…
CVE-2019-11043: PHP FastCGI Process Manager (FPM) Buffer Overflow Vulnerability, published 2019-10-28. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.7% chance of exploitation in the next 30 days. In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it is possible to cause FPM module to write past allocated buffers into the space…
CVE-2017-12615: Apache Tomcat on Windows Remote Code Execution Vulnerability, published 2017-09-19. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 99.6% chance of exploitation in the next 30 days. When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to…
CVE-2019-5544: VMware ESXi and Horizon DaaS OpenSLP Heap-Based Buffer Overflow Vulnerability, published 2019-12-06. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.3% chance of exploitation in the next 30 days. OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue. VMware has evaluated the severity of this issue to be in the Critical severity range with a maximum CVSSv3 base…
CVE-2021-4034: Red Hat Polkit Out-of-Bounds Read and Write Vulnerability, published 2022-01-28. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-27. EPSS: 94.9% chance of exploitation in the next 30 days. A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users…
CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.7% chance of exploitation in the next 30 days. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

Latest

CVE-2024-1086: Linux Kernel Use-After-Free Vulnerability, published 2024-01-31. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-05-30. EPSS: 28.1% chance of exploitation in the next 30 days. A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values…
CVE-2024-0409, published 2024-01-18. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. A flaw was found in the X.Org server. The cursor code in both Xephyr and Xwayland uses the wrong type of private at creation. It uses the cursor bits type with the cursor as private, and when…
CVE-2024-0408, published 2024-01-18. Medium severity, CVSS 5.5. EPSS: 0.3% chance of exploitation in the next 30 days. A flaw was found in the X.Org server. The GLX PBuffer code does not call the XACE hook when creating the buffer, leaving it unlabeled. When the client issues another request to access that resource…
CVE-2023-5455, published 2024-01-10. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. A Cross-site request forgery vulnerability exists in ipa/session/login_password in all supported versions of IPA. This flaw allows an attacker to trick the user into submitting a request that could…
CVE-2023-5869, published 2023-12-10. High severity, CVSS 8.8. EPSS: 4.3% chance of exploitation in the next 30 days. A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an…
CVE-2023-3972, published 2023-11-01. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A vulnerability was found in insights-client. This security issue occurs because of insecure file operations or unsafe handling of temporary files and directories that lead to local privilege…
CVE-2023-5367, published 2023-10-25. High severity, CVSS 7.8. EPSS: 0.6% chance of exploitation in the next 30 days. A out-of-bounds write flaw was found in the xorg-x11-server. This issue occurs due to an incorrect calculation of a buffer offset when copying data stored in the heap in the XIChangeDeviceProperty…
CVE-2023-3899, published 2023-08-23. High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days. A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods…
CVE-2023-0494, published 2023-03-27. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. A vulnerability was found in X.Org. This issue occurs due to a dangling pointer in DeepCopyPointerClasses that can be exploited by ProcXkbSetDeviceInfo() and ProcXkbGetDeviceInfo() to read and write…
CVE-2019-8720: WebKitGTK Memory Corruption Vulnerability, published 2023-03-06. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-05-23. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple…