Product:

Suse_linux_enterprise_server

(Suse)
Repositories • https://github.com/torvalds/linux
• https://github.com/git/git
• https://github.com/lighttpd/lighttpd1.4
#Vulnerabilities 129
Date Id Summary Products Score Patch Annotated
2018-03-01 CVE-2017-14798 A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root. Postgresql, Suse_linux_enterprise_server 7.0
2018-06-08 CVE-2011-3172 A vulnerability in pam_modules of SUSE Linux Enterprise allows attackers to log into accounts that should have been disabled. Affected releases are SUSE Linux Enterprise: versions prior to 12. Suse_linux_enterprise_server 9.8
2018-06-08 CVE-2011-4190 The kdump implementation is missing the host key verification in the kdump and mkdumprd OpenSSH integration of kdump prior to version 2012-01-20. This is similar to CVE-2011-3588, but different in that the kdump implementation is specific to SUSE. A remote malicious kdump server could use this flaw to impersonate the correct kdump server to obtain security sensitive information (kdump core files). Suse_linux_enterprise_desktop, Suse_linux_enterprise_server 5.3
2018-11-29 CVE-2018-19655 A stack-based buffer overflow in the find_green() function of dcraw through 9.28, as used in ufraw-batch and many other products, may allow a remote attacker to cause a control-flow hijack, denial-of-service, or unspecified other impact via a maliciously crafted raw photo file. Dcraw, Suse_linux_enterprise_desktop, Suse_linux_enterprise_server 8.8
2020-01-27 CVE-2018-20105 A Inclusion of Sensitive Information in Log Files vulnerability in yast2-rmt of SUSE Linux Enterprise Server 15; openSUSE Leap allows local attackers to learn the password if they can access the log file. This issue affects: SUSE Linux Enterprise Server 15 yast2-rmt versions prior to 1.2.2. openSUSE Leap yast2-rmt versions prior to 1.2.2. Leap, Suse_linux_enterprise_server, Yast2\-Rmt 5.5
2014-03-19 CVE-2014-1505 The SVG filter implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to obtain sensitive displacement-correlation information, and possibly bypass the Same Origin Policy and read text from a different domain, via a timing attack involving feDisplacementMap elements, a related issue to CVE-2013-1693. Ubuntu_linux, Debian_linux, Firefox, Firefox_esr, Seamonkey, Thunderbird, Suse_linux_enterprise_software_development_kit, Opensuse, Enterprise_linux_desktop, Enterprise_linux_eus, Enterprise_linux_server, Enterprise_linux_server_aus, Enterprise_linux_server_eus, Enterprise_linux_server_tus, Enterprise_linux_workstation, Suse_linux_enterprise_desktop, Suse_linux_enterprise_server 7.5
2016-04-08 CVE-2016-2315 revision.c in git before 2.7.4 uses an incorrect integer data type, which allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, leading to a heap-based buffer overflow. Git, Leap, Opensuse, Linux_enterprise_debuginfo, Linux_enterprise_server, Linux_enterprise_software_development_kit, Openstack_cloud, Suse_linux_enterprise_server 9.8
2016-04-08 CVE-2016-2324 Integer overflow in Git before 2.7.4 allows remote attackers to execute arbitrary code via a (1) long filename or (2) many nested trees, which triggers a heap-based buffer overflow. Git, Leap, Opensuse, Linux_enterprise_debuginfo, Linux_enterprise_server, Linux_enterprise_software_development_kit, Openstack_cloud, Suse_linux_enterprise_server 9.8
2014-04-27 CVE-2014-0181 The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program. Linux_kernel, Evergreen, Enterprise_linux_desktop, Enterprise_linux_server, Linux_enterprise_real_time_extension, Linux_enterprise_server, Suse_linux_enterprise_server N/A
2008-07-09 CVE-2008-2812 The Linux kernel before 2.6.25.10 does not properly perform tty operations, which allows local users to cause a denial of service (system crash) or possibly gain privileges via vectors involving NULL pointer dereference of function pointers in (1) hamradio/6pack.c, (2) hamradio/mkiss.c, (3) irda/irtty-sir.c, (4) ppp_async.c, (5) ppp_synctty.c, (6) slip.c, (7) wan/x25_asy.c, and (8) wireless/strip.c in drivers/net/. Communication_manager, Expanded_meet\-Me_conferencing, Intuity_audix_lx, Meeting_exchange, Message_networking, Messaging_storage_server, Proactive_contact, Sip_enablement_services, Ubuntu_linux, Debian_linux, Linux_kernel, Linux_desktop, Opensuse, Suse_linux_enterprise_desktop, Suse_linux_enterprise_server 7.8