Red Hat Enterprise Linux Server Supplementary Eus vulnerabilities

83 CVEs affecting Red Hat Enterprise Linux Server Supplementary Eus, 2 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-1666, published 2016-05-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-3718: ImageMagick Server-Side Request Forgery (SSRF) Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.7% chance of exploitation in the next 30 days. The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
CVE-2016-3715: ImageMagick Arbitrary File Deletion Vulnerability, published 2016-05-05. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 75.3% chance of exploitation in the next 30 days. The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
CVE-2015-3042, published 2015-04-14. High severity, CVSS 10.0. EPSS: 36.8% chance of exploitation in the next 30 days. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of…
CVE-2016-3717, published 2016-05-05. Medium severity, CVSS 5.5. EPSS: 20.4% chance of exploitation in the next 30 days. The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image.
CVE-2016-3716, published 2016-05-05. Low severity, CVSS 3.3. EPSS: 11.3% chance of exploitation in the next 30 days. The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image.
CVE-2015-0358, published 2015-04-14. High severity, CVSS 10.0. EPSS: 10.4% chance of exploitation in the next 30 days. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary…
CVE-2015-0346, published 2015-04-14. High severity, CVSS 10.0. EPSS: 10.4% chance of exploitation in the next 30 days. Double free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary…
CVE-2015-3044, published 2015-04-14. Medium severity, CVSS 5.0. EPSS: 9.4% chance of exploitation in the next 30 days. Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to bypass intended access restrictions and obtain…
CVE-2015-0348, published 2015-04-14. High severity, CVSS 10.0. EPSS: 8.8% chance of exploitation in the next 30 days. Buffer overflow in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code via…
CVE-2015-0349, published 2015-04-14. High severity, CVSS 10.0. EPSS: 8.2% chance of exploitation in the next 30 days. Use-after-free vulnerability in Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary…

Latest

CVE-2016-1666, published 2016-05-14. Critical severity, CVSS 9.8. EPSS: 1.4% chance of exploitation in the next 30 days. Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.94 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.
CVE-2016-1665, published 2016-05-14. Medium severity, CVSS 6.5. EPSS: 1.8% chance of exploitation in the next 30 days. The JSGenericLowering class in compiler/js-generic-lowering.cc in Google V8, as used in Google Chrome before 50.0.2661.94, mishandles comparison operators, which allows remote attackers to obtain…
CVE-2016-1664, published 2016-05-14. Medium severity, CVSS 4.3. EPSS: 1% chance of exploitation in the next 30 days. The HistoryController::UpdateForCommit function in content/renderer/history_controller.cc in Google Chrome before 50.0.2661.94 mishandles the interaction between subframe forward navigations and…
CVE-2016-1663, published 2016-05-14. High severity, CVSS 8.8. EPSS: 1% chance of exploitation in the next 30 days. The SerializedScriptValue::transferArrayBuffers function in WebKit/Source/bindings/core/v8/SerializedScriptValue.cpp in the V8 bindings in Blink, as used in Google Chrome before 50.0.2661.94,…
CVE-2016-1662, published 2016-05-14. Critical severity, CVSS 9.8. EPSS: 3.9% chance of exploitation in the next 30 days. extensions/renderer/gc_callback.cc in Google Chrome before 50.0.2661.94 does not prevent fallback execution once the Garbage Collection callback has started, which allows remote attackers to cause a…
CVE-2016-1661, published 2016-05-14. High severity, CVSS 8.0. EPSS: 1.2% chance of exploitation in the next 30 days. Blink, as used in Google Chrome before 50.0.2661.94, does not ensure that frames satisfy a check for the same renderer process in addition to a Same Origin Policy check, which allows remote attackers…
CVE-2016-1660, published 2016-05-14. High severity, CVSS 8.8. EPSS: 1.1% chance of exploitation in the next 30 days. Blink, as used in Google Chrome before 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes, which allows remote attackers to cause a denial of service…