This CPE summary could be partial or incomplete. Please contact us for a detailed listing.

Summary

Detail
Vendor Oracle First view 2007-12-17
Product Linux Last view 2023-09-20
Version 6 Type
Update  
Edition  
Language  
Sofware Edition  
Target Software  
Target Hardware  
Other  

Activity : Overall

COMMON PLATFORM ENUMERATION: Repartition per Version

CPE Name Affected CVE
cpe:2.3:o:oracle:linux:7:*:*:*:*:*:*:* 131
cpe:2.3:o:oracle:linux:6:*:*:*:*:*:*:* 87
cpe:2.3:o:oracle:linux:5.0:*:*:*:*:*:*:* 50
cpe:2.3:o:oracle:linux:7:-:*:*:*:*:*:* 44
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:* 37
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:* 15
cpe:2.3:o:oracle:linux:7:0:*:*:*:*:*:* 5
cpe:2.3:o:oracle:linux:8:-:*:*:*:*:*:* 5
cpe:2.3:o:oracle:linux:5:*:*:*:*:*:*:* 4
cpe:2.3:o:oracle:linux:4:*:*:*:*:*:*:* 1
cpe:2.3:o:oracle:linux:-:*:*:*:*:*:*:* 1
cpe:2.3:o:oracle:linux:9:-:*:*:*:*:*:* 1

Related : CVE

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
  Date Alert Description
5.5 2023-09-20 CVE-2023-22024

In the Unbreakable Enterprise Kernel (UEK), the RDS module in UEK has two setsockopt(2) options, RDS_CONN_RESET and RDS6_CONN_RESET, that are not re-entrant. A malicious local user with CAP_NET_ADMIN can use this to crash the kernel. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

6.2 2022-08-29 CVE-2022-21385

A flaw in net_rds_alloc_sgs() in Oracle Linux kernels allows unprivileged local users to crash the machine. CVSS 3.1 Base Score 6.2 (Availability impacts). CVSS Vector (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

5.5 2022-06-14 CVE-2022-21504

The code in UEK6 U3 was missing an appropiate file descriptor count to be missing. This resulted in a use count error that allowed a file descriptor to a socket to be closed and freed while it was still in use by another portion of the kernel. An attack with local access can operate on the socket, and cause a denial of service. CVSS 3.1 Base Score 5.5 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H).

6.7 2022-06-09 CVE-2022-21499

KGDB and KDB allow read and write access to kernel memory, and thus should be restricted during lockdown. An attacker with access to a serial port could trigger the debugger so it is important that the debugger respect the lockdown mode when/if it is triggered. CVSS 3.1 Base Score 6.7 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).

7.8 2022-02-16 CVE-2021-3551

A flaw was found in the PKI-server, where the spkispawn command, when run in debug mode, stores admin credentials in the installation log file. This flaw allows a local attacker to retrieve the file to obtain the admin password and gain admin privileges to the Dogtag CA manager. The highest threat from this vulnerability is to confidentiality.

7.8 2021-09-24 CVE-2021-2464

Vulnerability in Oracle Linux (component: OSwatcher). Supported versions that are affected are 7 and 8. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Linux executes to compromise Oracle Linux. Successful attacks of this vulnerability can result in takeover of Oracle Linux. CVSS 3.1 Base Score 7.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

7.5 2018-10-09 CVE-2018-17962

Qemu has a Buffer Overflow in pcnet_receive in hw/net/pcnet.c because an incorrect integer data type is used.

5.9 2017-08-07 CVE-2015-7852

ntpq in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted mode 6 response packets.

6.5 2017-08-07 CVE-2015-7702

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

7.5 2017-08-07 CVE-2015-7701

Memory leak in the CRYPTO_ASSOC function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (memory consumption).

7.5 2017-08-07 CVE-2015-7692

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash). NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

7.5 2017-08-07 CVE-2015-7691

The crypto_xmit function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (crash) via crafted packets containing particular autokey operations. NOTE: This vulnerability exists due to an incomplete fix for CVE-2014-9750.

7.5 2017-07-24 CVE-2015-7703

The "pidfile" or "driftfile" directives in NTP ntpd 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77, when ntpd is configured to allow remote configuration, allows remote attackers with an IP address that is allowed to send configuration requests, and with knowledge of the remote configuration password to write to arbitrary files via the :config command.

7.5 2017-07-21 CVE-2015-5219

The ULOGTOD function in ntp.d in SNTP before 4.2.7p366 does not properly perform type conversions from a precision value to a double, which allows remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

9.8 2017-04-11 CVE-2016-1908

The client in OpenSSH before 7.2 mishandles failed cookie generation for untrusted X11 forwarding and relies on the local X11 server for access-control decisions, which allows remote X11 clients to trigger a fallback and obtain trusted X11 forwarding privileges by leveraging configuration issues on this X11 server, as demonstrated by lack of the SECURITY extension on this X11 server.

6.5 2017-03-15 CVE-2015-8896

Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application crash) via a crafted .pict file.

5.3 2017-01-30 CVE-2016-2518

The MATCH_ASSOC function in NTP before version 4.2.8p9 and 4.3.x before 4.3.92 allows remote attackers to cause an out-of-bounds reference via an addpeer request with a large hmode value.

5.9 2017-01-30 CVE-2015-7977

ntpd in NTP before 4.2.8p6 and 4.3.x before 4.3.90 allows remote attackers to cause a denial of service (NULL pointer dereference) via a ntpdc reslist command.

7.5 2016-10-16 CVE-2016-7039

The IP stack in the Linux kernel through 4.8.2 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for large crafted packets, as demonstrated by packets that contain only VLAN headers, a related issue to CVE-2016-8666.

7.5 2016-09-28 CVE-2016-2776

buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.

5.5 2016-09-21 CVE-2016-7166

libarchive before 3.2.0 does not limit the number of recursive decompressions, which allows remote attackers to cause a denial of service (memory consumption and application crash) via a crafted gzip file.

8.6 2016-09-21 CVE-2016-6250

Integer overflow in the ISO9660 writer in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via vectors related to verifying filename lengths when writing an ISO9660 archive, which trigger a buffer overflow.

6.5 2016-09-21 CVE-2016-5844

Integer overflow in the ISO parser in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a crafted ISO file.

7.5 2016-09-21 CVE-2016-5418

The sandboxing code in libarchive 3.2.0 and earlier mishandles hardlink archive entries of non-zero data size, which might allow remote attackers to write to arbitrary files via a crafted archive file.

7.5 2016-09-21 CVE-2016-4809

The archive_read_format_cpio_read_header function in archive_read_support_format_cpio.c in libarchive before 3.2.1 allows remote attackers to cause a denial of service (application crash) via a CPIO archive with a large symlink.

CWE : Common Weakness Enumeration

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
%idName
26% (38) CWE-119 Failure to Constrain Operations within the Bounds of a Memory Buffer
17% (26) CWE-20 Improper Input Validation
5% (8) CWE-416 Use After Free
4% (6) CWE-399 Resource Management Errors
4% (6) CWE-200 Information Exposure
3% (5) CWE-787 Out-of-bounds Write
3% (5) CWE-190 Integer Overflow or Wraparound
3% (5) CWE-19 Data Handling
2% (4) CWE-476 NULL Pointer Dereference
2% (4) CWE-400 Uncontrolled Resource Consumption ('Resource Exhaustion')
2% (4) CWE-284 Access Control (Authorization) Issues
2% (4) CWE-125 Out-of-bounds Read
2% (3) CWE-269 Improper Privilege Management
2% (3) CWE-254 Security Features
2% (3) CWE-17 Code
1% (2) CWE-772 Missing Release of Resource after Effective Lifetime
1% (2) CWE-704 Incorrect Type Conversion or Cast
1% (2) CWE-362 Race Condition
1% (2) CWE-345 Insufficient Verification of Data Authenticity
1% (2) CWE-264 Permissions, Privileges, and Access Controls
1% (2) CWE-189 Numeric Errors
1% (2) CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflo...
1% (2) CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting')
0% (1) CWE-754 Improper Check for Unusual or Exceptional Conditions
0% (1) CWE-601 URL Redirection to Untrusted Site ('Open Redirect')

Oval Markup Language : Definitions

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
OvalID Name
oval:org.mitre.oval:def:9977 Red Hat Enterprise Linux 5 and Fedora install the Bind /etc/rndc.key file wit...
oval:org.mitre.oval:def:24449 Network Time Protocol (NTP) vulnerability in AIX
oval:org.mitre.oval:def:26210 SUSE-SU-2014:0937-1 -- Security update for ntp
oval:org.mitre.oval:def:24872 USN-2219-1 -- linux vulnerabilities
oval:org.mitre.oval:def:24778 USN-2220-1 -- linux-ec2 vulnerabilities
oval:org.mitre.oval:def:27184 ELSA-2014-0981 -- kernel security, bug fix, and enhancement update (important)
oval:org.mitre.oval:def:26359 ELSA-2014-3052 -- unbreakable enterprise kernel security update (important)
oval:org.mitre.oval:def:28989 HP-UX Apache Server Suite running Apache Tomcat or PHP, Remote Denial of Ser...
oval:org.mitre.oval:def:24863 USN-2196-1 -- linux vulnerability
oval:org.mitre.oval:def:24838 USN-2198-1 -- linux vulnerability
oval:org.mitre.oval:def:24818 USN-2197-1 -- linux-ec2 vulnerability
oval:org.mitre.oval:def:24747 USN-2204-1 -- linux vulnerability
oval:org.mitre.oval:def:24706 USN-2201-1 -- linux-lts-saucy vulnerability
oval:org.mitre.oval:def:24673 USN-2199-1 -- linux-lts-quantal vulnerability
oval:org.mitre.oval:def:24668 USN-2202-1 -- linux vulnerability
oval:org.mitre.oval:def:24543 USN-2203-1 -- linux vulnerability
oval:org.mitre.oval:def:24445 USN-2200-1 -- linux-lts-raring vulnerability
oval:org.mitre.oval:def:25258 RHSA-2014:0678: kernel security update (Important)
oval:org.mitre.oval:def:25233 SUSE-SU-2014:0667-1 -- Security update for Linux Kernel
oval:org.mitre.oval:def:27162 ELSA-2014-0678 -- kernel security update (important)
oval:org.mitre.oval:def:24487 DSA-2928-1 linux-2.6 - security update
oval:org.mitre.oval:def:24204 RHSA-2014:0740: kernel security and bug fix update (Important)
oval:org.mitre.oval:def:24916 ELSA-2014:0740: kernel security and bug fix update (Important)
oval:org.mitre.oval:def:25440 SUSE-SU-2014:0773-1 -- Security update for Linux Kernel
oval:org.mitre.oval:def:25438 SUSE-SU-2014:0772-1 -- Security update for Linux Kernel

Open Source Vulnerability Database (OSVDB)

id Description
76808 Oracle Linux Validated Component Unspecified Remote Issue
42655 ISC BIND on Red Hat Linux /etc/rndc.key Insecure File Permission Local named ...

ExploitDB Exploits

id Description
33516 Linux kernel 3.14-rc1 <= 3.15-rc4 - Raw Mode PTY Local Echo Race Condition...
33073 NTP ntpd monlist Query Reflection - Denial of Service

OpenVAS Exploits

id Description
2009-03-06 Name : RedHat Update for bind RHSA-2008:0300-02
File : nvt/gb_RHSA-2008_0300-02_bind.nasl
2009-02-27 Name : Fedora Update for bind FEDORA-2007-4655
File : nvt/gb_fedora_2007_4655_bind_fc8.nasl
2009-02-27 Name : Fedora Update for bind FEDORA-2007-4658
File : nvt/gb_fedora_2007_4658_bind_fc7.nasl
2009-02-17 Name : Fedora Update for bind FEDORA-2008-0903
File : nvt/gb_fedora_2008_0903_bind_fc8.nasl
2009-02-17 Name : Fedora Update for bind FEDORA-2008-0904
File : nvt/gb_fedora_2008_0904_bind_fc7.nasl
2009-02-17 Name : Fedora Update for bind FEDORA-2008-6281
File : nvt/gb_fedora_2008_6281_bind_fc8.nasl

Information Assurance Vulnerability Management (IAVM)

id Description
2015-A-0202 Citrix XenServer Information Disclosure Vulnerability
Severity: Category I - VMSKEY: V0061343
2015-A-0199 Multiple Vulnerabilities in Apple Mac OS X
Severity: Category I - VMSKEY: V0061337
2015-A-0174 Multiple Vulnerabilities in Apache HTTP Server
Severity: Category I - VMSKEY: V0061135
2014-B-0086 Multiple Vulnerabilities in PHP
Severity: Category I - VMSKEY: V0052897
2011-A-0143 Oracle Linux Security Vulnerability
Severity: Category II - VMSKEY: V0030423

Snort® IPS/IDS

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
Date Description
2018-06-21 Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt
RuleID : 46781 - Type : BROWSER-FIREFOX - Revision : 2
2018-06-21 Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt
RuleID : 46767 - Type : BROWSER-FIREFOX - Revision : 4
2018-06-21 Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt
RuleID : 46766 - Type : BROWSER-FIREFOX - Revision : 2
2018-06-21 Mozilla Firefox nsHTMLDocument SetBody use-after-free attempt
RuleID : 46765 - Type : BROWSER-FIREFOX - Revision : 2
2018-03-01 Squid host header cache poisoning attempt
RuleID : 45569 - Type : SERVER-WEBAPP - Revision : 1
2018-05-23 SSDP M-SEARCH ssdp-all potential amplified distributed denial-of-service attempt
RuleID : 45157-community - Type : SERVER-OTHER - Revision : 4
2018-01-11 SSDP M-SEARCH ssdp-all potential amplified distributed denial-of-service attempt
RuleID : 45157 - Type : SERVER-OTHER - Revision : 4
2017-10-24 PHP form-based file upload DoS attempt
RuleID : 44390 - Type : SERVER-WEBAPP - Revision : 2
2017-07-25 Squid ESI processing buffer overflow attempt
RuleID : 43268 - Type : SERVER-WEBAPP - Revision : 2
2017-01-12 Nitro Pro PDF Reader out of bounds write attempt
RuleID : 41197 - Type : FILE-PDF - Revision : 5
2017-01-12 Nitro Pro PDF Reader out of bounds write attempt
RuleID : 41196 - Type : FILE-PDF - Revision : 5
2016-11-08 Mozilla Firefox CSP report-uri arbitrary file write attempt
RuleID : 40363 - Type : BROWSER-FIREFOX - Revision : 2
2016-11-08 ISC BIND isc__buffer_add assertion failure denial of service attempt
RuleID : 40344 - Type : PROTOCOL-DNS - Revision : 2
2016-09-27 WordPress pingback gethostbyname heap buffer overflow attempt
RuleID : 39925 - Type : SERVER-WEBAPP - Revision : 2
2016-07-28 HttpOxy CGI application vulnerability potential man-in-the-middle attempt
RuleID : 39737-community - Type : SERVER-WEBAPP - Revision : 2
2016-08-31 HttpOxy CGI application vulnerability potential man-in-the-middle attempt
RuleID : 39737 - Type : SERVER-WEBAPP - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39097 - Type : FILE-IMAGE - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39096 - Type : FILE-IMAGE - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39095 - Type : FILE-IMAGE - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39094 - Type : FILE-IMAGE - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39093 - Type : FILE-IMAGE - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39092 - Type : FILE-IMAGE - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39091 - Type : FILE-IMAGE - Revision : 2
2016-07-01 ImageMagick and GraphicsMagick OpenBlob command injection attempt
RuleID : 39090 - Type : FILE-IMAGE - Revision : 2
2016-03-14 NTP arbitrary pidfile and driftfile overwrite attempt
RuleID : 37526 - Type : SERVER-OTHER - Revision : 3

Nessus® Vulnerability Scanner

This CPE Product have more than 25 Relations. If you want to see a complete summary for this CPE, please contact us.
id Description
2019-01-03 Name: The remote Fedora host is missing a security update.
File: fedora_2018-87f2ace20d.nasl - Type: ACT_GATHER_INFO
2018-12-01 Name: The remote Debian host is missing a security update.
File: debian_DLA-1599.nasl - Type: ACT_GATHER_INFO
2018-11-16 Name: The remote CentOS host is missing one or more security updates.
File: centos_RHSA-2018-3083.nasl - Type: ACT_GATHER_INFO
2018-11-13 Name: The remote Debian host is missing a security-related update.
File: debian_DSA-4338.nasl - Type: ACT_GATHER_INFO
2018-09-12 Name: The remote Debian host is missing a security update.
File: debian_DLA-1500.nasl - Type: ACT_GATHER_INFO
2018-08-17 Name: The remote PhotonOS host is missing multiple security updates.
File: PhotonOS_PHSA-2017-0010.nasl - Type: ACT_GATHER_INFO
2018-08-17 Name: The remote PhotonOS host is missing multiple security updates.
File: PhotonOS_PHSA-2017-0011.nasl - Type: ACT_GATHER_INFO
2018-08-17 Name: The remote PhotonOS host is missing multiple security updates.
File: PhotonOS_PHSA-2017-0021.nasl - Type: ACT_GATHER_INFO
2018-08-15 Name: The remote device is missing a vendor-supplied security patch.
File: f5_bigip_SOL53729441.nasl - Type: ACT_GATHER_INFO
2018-04-10 Name: The remote Gentoo host is missing one or more security-related patches.
File: gentoo_GLSA-201804-06.nasl - Type: ACT_GATHER_INFO
2018-02-28 Name: The version of Arista Networks EOS running on the remote device is affected b...
File: arista_eos_sa0024.nasl - Type: ACT_GATHER_INFO
2018-02-28 Name: The version of Arista Networks EOS running on the remote device is affected b...
File: arista_eos_sa0024_4_17.nasl - Type: ACT_GATHER_INFO
2017-12-04 Name: The remote host is missing a vendor-supplied security patch.
File: check_point_gaia_sk104443.nasl - Type: ACT_GATHER_INFO
2017-11-03 Name: The remote host is missing a macOS or Mac OS X security update that fixes mul...
File: macosx_SecUpd2017-004.nasl - Type: ACT_GATHER_INFO
2017-10-27 Name: The remote OracleVM host is missing one or more security updates.
File: oraclevm_OVMSA-2017-0165.nasl - Type: ACT_GATHER_INFO
2017-10-23 Name: The remote device is affected by multiple vulnerabilities.
File: juniper_space_jsa_10826.nasl - Type: ACT_GATHER_INFO
2017-10-03 Name: The remote host is missing a macOS update that fixes multiple security vulner...
File: macos_10_13.nasl - Type: ACT_GATHER_INFO
2017-08-09 Name: The remote AIX host has a version of NTP installed that is affected by multip...
File: aix_ntp_v3_advisory4.nasl - Type: ACT_GATHER_INFO
2017-08-09 Name: The remote AIX host has a version of NTP installed that is affected by multip...
File: aix_ntp_v4_advisory4.nasl - Type: ACT_GATHER_INFO
2017-08-03 Name: The remote AIX host has a version of bind installed that is affected by a den...
File: aix_bind_advisory10.nasl - Type: ACT_GATHER_INFO
2017-08-03 Name: The remote AIX host has a version of bind installed that is affected by multi...
File: aix_bind_advisory13.nasl - Type: ACT_GATHER_INFO
2017-08-03 Name: The remote AIX host has a version of NTP installed that is affected by multip...
File: aix_ntp_v3_advisory7.nasl - Type: ACT_GATHER_INFO
2017-07-20 Name: A web application installed on the remote host is affected by multiple vulner...
File: oracle_e-business_cpu_jul_2017.nasl - Type: ACT_GATHER_INFO
2017-07-20 Name: An enterprise management application installed on the remote host is affected...
File: oracle_enterprise_manager_jul_2017_cpu.nasl - Type: ACT_GATHER_INFO
2017-07-20 Name: The remote Ubuntu host is missing one or more security-related patches.
File: ubuntu_USN-3212-3.nasl - Type: ACT_GATHER_INFO