Red Hat Enterprise Linux Hpc Node Eus vulnerabilities

81 CVEs affecting Red Hat Enterprise Linux Hpc Node Eus, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2015-3149, published 2017-07-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.7% chance of exploitation in the next 30 days. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2015-7547, published 2016-02-18. High severity, CVSS 8.1. EPSS: 91% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a…
CVE-2016-2107, published 2016-05-05. Medium severity, CVSS 5.9. EPSS: 89.1% chance of exploitation in the next 30 days. The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive…
CVE-2016-2108, published 2016-05-05. Critical severity, CVSS 9.8. EPSS: 77.9% chance of exploitation in the next 30 days. The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffer underflow and memory corruption) via…
CVE-2016-5388, published 2016-07-19. High severity, CVSS 8.1. EPSS: 50.9% chance of exploitation in the next 30 days. Apache Tomcat 7.x through 7.0.70 and 8.x through 8.5.4, when the CGI Servlet is enabled, follows RFC 3875 section 4.1.18 and therefore does not protect applications from the presence of untrusted…
CVE-2015-4024, published 2015-06-09. Medium severity, CVSS 5.0. EPSS: 49.9% chance of exploitation in the next 30 days. Algorithmic complexity vulnerability in the multipart_buffer_headers function in main/rfc1867.c in PHP before 5.4.41, 5.5.x before 5.5.25, and 5.6.x before 5.6.9 allows remote attackers to cause a…
CVE-2016-2105, published 2016-05-05. High severity, CVSS 7.5. EPSS: 39.7% chance of exploitation in the next 30 days. Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (heap memory corruption)…
CVE-2015-3329, published 2015-06-09. High severity, CVSS 7.5. EPSS: 38.2% chance of exploitation in the next 30 days. Multiple stack-based buffer overflows in the phar_set_inode function in phar_internal.h in PHP before 5.4.40, 5.5.x before 5.5.24, and 5.6.x before 5.6.8 allow remote attackers to execute arbitrary…
CVE-2016-2109, published 2016-05-05. High severity, CVSS 7.5. EPSS: 29.2% chance of exploitation in the next 30 days. The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a denial of service (memory…

Latest

CVE-2015-3149, published 2017-07-25. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. The Hotspot component in OpenJDK8 as packaged in Red Hat Enterprise Linux 6 and 7 allows local users to write to arbitrary files via a symlink attack.
CVE-2015-5300, published 2017-07-21. High severity, CVSS 7.5. EPSS: 9.1% chance of exploitation in the next 30 days. The panic_gate check in NTP before 4.2.8p5 is only re-enabled after the first change to the system clock that was greater than 128 milliseconds by default, which allows remote attackers to set NTP to…
CVE-2016-7166, published 2016-09-21. Medium severity, CVSS 5.5. EPSS: 1.6% chance of exploitation in the next 30 days. libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip…
CVE-2016-5844, published 2016-09-21. Medium severity, CVSS 6.5. EPSS: 4.1% chance of exploitation in the next 30 days. Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.
CVE-2016-5418, published 2016-09-21. High severity, CVSS 7.5. EPSS: 4.7% chance of exploitation in the next 30 days. The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive…
CVE-2016-4809, published 2016-09-21. High severity, CVSS 7.5. EPSS: 4.8% chance of exploitation in the next 30 days. The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO…
CVE-2016-4302, published 2016-09-21. High severity, CVSS 7.8. EPSS: 4.8% chance of exploitation in the next 30 days. Heap-based buffer overflow in the parse_codes function in archive_read_support_format_rar.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a RAR file with a…
CVE-2016-4300, published 2016-09-21. High severity, CVSS 7.8. EPSS: 4.9% chance of exploitation in the next 30 days. Integer overflow in the read_SubStreamsInfo function in archive_read_support_format_7zip.c in libarchive before 3.2.1 allows remote attackers to execute arbitrary code via a 7zip file with a large…
CVE-2016-4470, published 2016-06-27. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of…