Linux Enterprise Software Development Kit vulnerabilities

13 known vulnerabilities in Linux Enterprise Software Development Kit from SUSE. 10 are rated high or critical, and 12 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Cifs-utils: Out-of-bounds Write

  CVE-2022-27239Apr 27, 2022Samba

  In cifs-utils through 6.14, a stack-based buffer overflow when parsing the mount.cifs ip= command-line argument could lead to local attackers gaining root privileges.

• 5.5 Medium severity

  ImageMagick Server-Side Request Forgery (SSRF) Exploited

  CVE-2016-3718May 5, 2016Red HatEPSS 75.6%

  The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

• 5.5 Medium severity

  ImageMagick Arbitrary File Deletion Exploited

  CVE-2016-3715May 5, 2016Red HatEPSS 75.3%

  The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

• 9.8 Critical severity

  Oracle Java SE and JRockit Unspecified Exploited

  CVE-2016-3427Apr 21, 2016OracleEPSS 92.3%

  Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.

• 5.0 Medium severity

  Oracle Java SE Integrity Check Exploited

  CVE-2015-4902Oct 22, 2015OracleEPSS 13.6%

  Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

• 8.8 High severity

  Mozilla Firefox Security Feature Bypass Exploited

  CVE-2015-4495Aug 8, 2015MozillaEPSS 68.6%

  The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same Origin Policy, and read arbitrary files or gain privileges, via vectors involving crafted JavaScript code and

• 7.8 High severity

  ISC BIND Data Processing Errors Exploited

  CVE-2015-5477Jul 29, 2015Juniper NetworksEPSS 99.6%

  named in ISC BIND 9.x before 9.9.7-P2 and 9.10.x before 9.10.2-P3 allows remote attackers to cause a denial of service (REQUIRE assertion failure and daemon exit) via TKEY queries.

• 9.8 Critical severity

  GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited

  CVE-2014-7169Sep 25, 2014GNUEPSS 99.9%

  GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as

• 9.8 Critical severity

  GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Exploited

  CVE-2014-6271Sep 24, 2014GNUEPSS 100%

  GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature

• 8.8 High severity

  Mozilla Firefox and Thunderbird Denial-of-Service Exploited

  CVE-2013-1690Jun 26, 2013MozillaEPSS 69%

  Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle onreadystatechange events in conjunction with page reloading, which allows remote attackers to cause a denial

• 10.0 High severity

  Oracle Java SE Unspecified Exploited

  CVE-2013-2465Jun 18, 2013OracleEPSS 98.8%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availa

• 10.0 High severity

  Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Exploited

  CVE-2012-0507Jun 7, 2012Sun MicrosystemsEPSS 98.2%

  Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 2 and earlier, 6 Update 30 and earlier, and 5.0 Update 33 and earlier allows remote attackers to affect confidentiality, integrity, and availability via unknow

• 7.5 High severity

  PHP-CGI Query String Parameter Exploited

  CVE-2012-1823May 11, 2012PHPEPSS 100%

  sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not properly handle query strings that lack an = (equals sign) character, which allows remote attackers to execute arbitrary code by placing co