Red Hat Enterprise Linux Server From Rhui vulnerabilities

CVE-2016-4117 Critical · 9.8 KEV Urgent · 100 Public exploit Ransomware May 10, 2016

Adobe Flash Player Arbitrary Code Execution Vulnerability

Adobe Flash Player 21.0.0.226 and earlier allows remote attackers to execute arbitrary code via unspecified vectors, as exploited in the wild in May 2016.

CVE-2016-3718 Medium · 5.5 KEV High · 61 Public exploit CWE-918 May 5, 2016

ImageMagick Server-Side Request Forgery (SSRF) Vulnerability

The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.

CVE-2016-3715 Medium · 5.5 KEV High · 61 Public exploit CWE-552 May 5, 2016

ImageMagick Arbitrary File Deletion Vulnerability

The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.

CVE-2015-4902 Medium · 5.3 KEV High · 65 CWE-284 Oct 21, 2015

Oracle Java SE Integrity Check Vulnerability

Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deployment.

CVE-2015-7645 High · 7.8 KEV Urgent · 74 Public exploit Ransomware Oct 15, 2015

Adobe Flash Player Arbitrary Code Execution Vulnerability

Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attackers to execute arbitrary code via a crafted SWF file, as exploited in the wild in October 2015.

CVE-2015-5119 Critical · 9.8 KEV Urgent · 90 Public exploit CWE-416 Jul 8, 2015

Adobe Flash Player Use-After-Free Vulnerability

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

CVE-2015-3043 Critical · 9.8 KEV Urgent · 80 Public exploit CWE-787 Apr 14, 2015

Adobe Flash Player Memory Corruption Vulnerability

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.

CVE-2014-7169 Critical · 9.8 KEV Urgent · 71 Public exploit CWE-78 Sep 24, 2014

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.

CVE-2014-6271 Critical · 9.8 KEV Urgent · 83 Public exploit CWE-78 Sep 24, 2014

GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability

GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution, aka "ShellShock." NOTE: the original fix for this issue was incorrect; CVE-2014-7169 has been assigned to cover the vulnerability that is still present after the incorrect fix.