Enterprise Linux Desktop vulnerabilities

65 known vulnerabilities in Enterprise Linux Desktop from Red Hat. 61 are rated high or critical, and 57 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Adobe Flash Player Arbitrary Code Execution Exploited

  CVE-2015-7645Oct 15, 2015AdobeEPSS 65.3%

  Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

• 8.8 High severity

  Mozilla Firefox Security Feature Bypass Exploited

  CVE-2015-4495Aug 8, 2015MozillaEPSS 68.6%

  The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and

• 9.8 Critical severity

  Oracle Java SE and Java SE Embedded Remote Code Execution Exploited

  CVE-2015-2590Jul 16, 2015OracleEPSS 25.5%

  Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-201

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-5123Jul 14, 2015Red HatEPSS 18.8%

  Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-5122Jul 14, 2015AdobeEPSS 87%

  Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x thro

• 9.8 Critical severity

  Adobe Flash Player Use-After-Free Exploited

  CVE-2015-5119Jul 8, 2015AdobeEPSS 98.6%

  Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execu

• 9.8 Critical severity

  Adobe Flash Player Heap-Based Buffer Overflow Exploited

  CVE-2015-3113Jun 23, 2015AdobeEPSS 99.8%

  Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11.2.202.468 on Linux allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild

• 9.8 Critical severity

  Adobe Flash Player Memory Corruption Exploited

  CVE-2015-3043Apr 14, 2015AdobeEPSS 73.9%

  Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited

• 9.8 Critical severity

  GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited

  CVE-2014-7169Sep 25, 2014GNUEPSS 99.9%

  GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as

• 9.8 Critical severity

  GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited

  CVE-2014-6271Sep 24, 2014GNUEPSS 100%

  GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature

• 7.5 High severity

  OpenSSL Information Disclosure Exploited

  CVE-2014-0160Apr 7, 2014OpenSSLEPSS 100%

  The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via crafted packets that trigger a buffer over-read, a

• 8.8 High severity

  Adobe Flash Player Double Free Vulnerablity Exploited

  CVE-2014-0502Feb 21, 2014AdobeEPSS 24.8%

  Double free vulnerability in Adobe Flash Player before 11.7.700.269 and 11.8.x through 12.0.x before 12.0.0.70 on Windows and Mac OS X and before 11.2.202.341 on Linux, Adobe AIR before 4.0.0.1628 on Android, Adobe AIR SDK before 4.0.0.1628, and Adobe AIR SDK

• 9.8 Critical severity

  Adobe Flash Player Integer Underflow Vulnerablity Exploited

  CVE-2014-0497Feb 5, 2014AdobeEPSS 99.9%

  Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.

• 8.8 High severity

  Mozilla Firefox and Thunderbird Denial-of-Service Exploited

  CVE-2013-1690Jun 26, 2013MozillaEPSS 69%

  Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial

• 9.8 Critical severity

  Adobe Reader and Acrobat Arbitrary Integer Overflow Exploited

  CVE-2013-2729May 16, 2013AdobeEPSS 66.6%

  Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code via unspecified vectors, a different vulnerability than CVE-2013-2727.

• 6.5 Medium severity

  Mozilla Firefox Information Disclosure Exploited

  CVE-2013-1675May 16, 2013MozillaEPSS 6.7%

  Mozilla Firefox before 21.0, Firefox ESR 17.x before 17.0.6, Thunderbird before 17.0.6, and Thunderbird ESR 17.x before 17.0.6 do not properly initialize data structures for the nsDOMSVGZoomEvent::mPreviousScale and nsDOMSVGZoomEvent::mNewScale functions, whic

• 8.8 High severity

  Adobe Flash Player Code Execution Exploited

  CVE-2013-0648Feb 27, 2013AdobeEPSS 11.1%

  Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, allows remote attackers t

• 8.8 High severity

  Adobe Flash Player Incorrect Default Permissions Exploited

  CVE-2013-0643Feb 27, 2013AdobeEPSS 10.5%

  The Firefox sandbox in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on Windows and Mac OS X, and before 10.3.183.67 and 11.x before 11.2.202.273 on Linux, does not properly restrict privileges, which makes it easier for remote attackers t

• 7.8 High severity

  Adobe Reader Buffer Overflow Exploited

  CVE-2013-0641Feb 14, 2013AdobeEPSS 32.3%

  Buffer overflow in Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allows remote attackers to execute arbitrary code via a crafted PDF document, as exploited in the wild in February 2013.

• 7.8 High severity

  Adobe Reader and Acrobat Memory Corruption Exploited

  CVE-2013-0640Feb 14, 2013AdobeEPSS 86.9%

  Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted PDF document, as exploited in the wild in February 2013.

• 9.8 Critical severity

  Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Exploited

  CVE-2012-4681Aug 28, 2012OracleEPSS 98.5%

  Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder

• 7.8 High severity

  Adobe Flash Player Arbitrary Code Execution Exploited

  CVE-2012-1535Aug 15, 2012AdobeEPSS 70.4%

  Unspecified vulnerability in Adobe Flash Player before 11.3.300.271 on Windows and Mac OS X and before 11.2.202.238 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via crafted SWF content, as exploite

• 10.0 High severity

  Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Exploited

  CVE-2012-1723Jun 16, 2012OracleEPSS 93.6%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows remote attackers to affect confidentiality, integrity, and ava

• 7.5 High severity

  Adobe Flash Player Memory Corruption Exploited

  CVE-2012-2034Jun 9, 2012AdobeEPSS 7.71%

  Adobe Flash Player before 10.3.183.20 and 11.x before 11.3.300.257 on Windows and Mac OS X; before 10.3.183.20 and 11.x before 11.2.202.236 on Linux; before 11.1.111.10 on Android 2.x and 3.x; and before 11.1.115.9 on Android 4.x, and Adobe AIR before 3.3.0.36

• 7.5 High severity

  PHP-CGI Query String Parameter Exploited

  CVE-2012-1823May 11, 2012PHPEPSS 100%

  sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing co