CVEs published July 27, 2018
76 CVEs were published on July 27, 2018: 0 critical, 18 high.
- Published
- 76
- Critical
- 0
- High
- 18
- Medium
- 31
- Low
- 8
- Unrated
- 19
- Now in CISA KEV
- 0
- Fix available
- 10
Most affected products
- netpbm
- 5
- Qemu:
- 4
- [UNKNOWN] undertow · io.undertow:undertow-core
- 2
- Red Hat business-central
- 2
- Red Hat spice
- 2
- [UNKNOWN] ceph
- 1
- [UNKNOWN] CFME
- 1
- [UNKNOWN] CloudForms
- 1
- [UNKNOWN] JBoss
- 1
- [UNKNOWN] kernel
- 1
High 18
- CVE-2016-9578A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling.Red Hat spice
- CVE-2017-15118A stack-based buffer overflow vulnerability was found in NBD server implementation in qemu before 2.11 allowing a client to request an exporQemu
- CVE-2016-9577A vulnerability was discovered in SPICE before 0.13.90 in the server's protocol handling.Red Hat spice
- CVE-2017-15101A missing patch for a stack-based buffer overflow in findTable() was found in Red Hat version of liblouis before 2.5.4.liblouis
- CVE-2017-2663It was found that subscription-manager's DBus interface before 1.19.4 let unprivileged user access the com.redhat.RHSM1.Facts.GetFacts and cRed Hat subscription-manager
- CVE-2017-2634It was found that the Linux kernel's Datagram Congestion Control Protocol (DCCP) implementation before 2.6.22.17 used the IPv4-only inet_sk_Linux kernel:
- CVE-2016-9595A flaw was found in katello-debug before 3.4.0 where certain scripts and log files used insecure temporary files.Foreman katello-debug
- CVE-2017-2590A vulnerability was found in ipa before 4.4.Red Hat ipa
- CVE-2017-2640An out-of-bounds write flaw was found in the way Pidgin before 2.12.0 processed XML content.pidgin
- CVE-2017-2646It was found that when Keycloak before 2.5.5 receives a Logout request with a Extensions in the middle of the request, the SAMLSloRequestParRed Hat keycloak · org.keycloak:keycloak-core
- CVE-2017-12148A flaw was found in Ansible Tower's interface before 3.1.5 and 3.2.0 with SCM repositories.Red Hat Ansible Tower
- CVE-2017-15113ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking.Red Hat ovirt-engine
- CVE-2017-15120An issue has been found in the parsing of authoritative answers in PowerDNS Recursor before 4.0.8, leading to a NULL pointer dereference whePowerDNS pdns-recursor
- CVE-2017-2595It was found that the log file viewer in Red Hat JBoss Enterprise Application 6 and 7 allows arbitrary file read to authenticated user via p[UNKNOWN] wildfly
- CVE-2017-2670It was found in Undertow before 1.3.28 that with non-clean TCP close, the Websocket server gets into infinite loop on every IO thread, effec[UNKNOWN] undertow · io.undertow:undertow-core
- CVE-2018-6686Drive Encryption (MDE) - Authentication Bypass vulnerabilityMcAfee Drive Encryption
- CVE-2017-12151A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3samba
- CVE-2017-7464It was found that the JAXP implementation used in JBoss EAP 7.0 for SAX and DOM parsing is vulnerable to certain XXE flaws.[UNKNOWN] JBoss
Medium, low and unrated 58
- CVE-2016-9603A heap buffer overflow flaw was found in QEMU's Cirrus CLGD 54xx VGA emulator's VNC display driver support before 2.9; the issue could occurQemu:
- CVE-2017-15097Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL.Red Hat postgresql init script
- CVE-2017-2648It was found that jenkins-ssh-slaves-plugin before version 1.15 did not perform host key verification, thereby enabling Man-in-the-Middle atjenkins-ssh-slaves-plugin · org.jenkins-ci.plugins:ssh-slav…
- CVE-2017-2649It was found that the Active Directory Plugin for Jenkins up to and including version 2.2 did not verify certificates of the Active DirectorJenkins project Active Directory Jenkins plugin · org.jenki…
- CVE-2017-2650It was found that the use of Pipeline: Classpath Step Jenkins plugin enables a bypass of the Script Security sandbox for users with SCM commJenkins project Pipeline: Classpath Step Jenkins plugin · c…
- CVE-2017-2652It was found that there were no permission checks performed in the Distributed Fork plugin before and including 1.5.0 for Jenkins that proviJenkins project DistFork Jenkins plugin · org.jenkins-ci.pl…
- CVE-2017-2616A race condition was found in util-linux before 2.32.1 in the way su handled the management of child processes.util-linux
- CVE-2017-2618A flaw was found in the Linux kernel's handling of clearing SELinux attributes on /proc/pid/attr files before 4.9.10.Linux kernel
- CVE-2017-2620Quick emulator (QEMU) before 2.8 built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to an out-of-bounds access issue.Qemu:
- CVE-2017-2626It was discovered that libICE before 1.0.9-8 used a weak entropy to generate keys.Xorg libICE
- CVE-2017-2629curl before 7.53.0 has an incorrect TLS Certificate Status Request extension feature that asks for a fresh proof of the server's certificatecurl
- CVE-2017-2632A logic error in valid_role() in CloudForms role validation before 5.7.1.3 could allow a tenant administrator to create groups with a higherRed Hat cfme
- CVE-2017-2633An out-of-bounds memory access issue was found in Quick Emulator (QEMU) before 1.7.2 in the VNC display driver.Qemu:
- CVE-2017-2579An out-of-bounds read vulnerability was found in netpbm before 10.61.netpbm
- CVE-2017-2580An out-of-bounds write vulnerability was found in netpbm before 10.61.netpbm
- CVE-2017-2581An out-of-bounds write vulnerability was found in netpbm before 10.61.netpbm
- CVE-2017-2586A null pointer dereference vulnerability was found in netpbm before 10.61.netpbm
- CVE-2017-2587A memory allocation vulnerability was found in netpbm before 10.61.netpbm
- CVE-2017-2614When updating a password in the rhvm database the ovirt-aaa-jdbc-tool tools before 1.1.3 fail to correctly check for the current password ifRed Hat ovirt-engine-extension-aaa-jdbc
- CVE-2017-2621An access-control flaw was found in the OpenStack Orchestration (heat) service before 8.0.0, 6.1.0 and 7.0.2 where a service log directory wRed Hat openstack-heat
- CVE-2017-2623It was discovered that rpm-ostree and rpm-ostree-client before 2017.3 fail to properly check GPG signatures on packages when doing layering.Project Atomic rpm-ostree,
- CVE-2017-2624It was found that xorg-x11-server before 1.19.0 including uses memcmp() to check the received MIT cookie against a series of valid cookies.xorg-x11-server
- CVE-2017-2625It was discovered that libXdmcp before 1.1.2 including used weak entropy to generate session keys.Xorg libXdmcp
- CVE-2017-2630A stack buffer overflow flaw was found in the Quick Emulator (QEMU) before 2.9 built with the Network Block Device (NBD) client support.Qemu:
- CVE-2017-2651jenkins-mailer-plugin before version 1.20 is vulnerable to an information disclosure while using the feature to send emails to a dynamicallyjenkins-mailer-plugin · org.jenkins-ci.plugins:mailer
- CVE-2017-2653A number of unused delete routes are present in CloudForms before 5.7.2.1 which can be accessed via GET requests instead of just POST requesRed Hat CloudForms
- CVE-2017-2658It was discovered that the Dashbuilder login page as used in Red Hat JBoss BPM Suite before 6.4.2 and Red Hat JBoss Data Virtualization & SeRed Hat BPMS · Red Hat JDV
- CVE-2017-2674JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a stored XSS via several lists in Business Central.Red Hat business-central
- CVE-2017-7463JBoss BRMS 6 and BPM Suite 6 before 6.4.3 are vulnerable to a reflected XSS via artifact upload.Red Hat business-central
- CVE-2018-1056An out-of-bounds heap buffer read flaw was found in the way advancecomp before 2.1-2018/02 handled processing of ZIP files.amadvance advancecomp:
- CVE-2018-10882A flaw was found in the Linux kernel's ext4 filesystem.[UNKNOWN] kernel
- CVE-2017-12173It was found that sssd's sysdb_search_user_by_upn_res() function before 1.16.0 did not sanitize requests when querying its local cache and wsssd
- CVE-2017-15119The Network Block Device (NBD) server in Quick Emulator (QEMU) before 2.11 is vulnerable to a denial of service issue.qemu
- CVE-2017-12165It was discovered that Undertow before 1.4.17, 1.3.31 and 2.0.0 processes http request headers with unusual whitespaces which can cause possRed Hat undertow · io.undertow:undertow-core
- CVE-2017-12195A flaw was found in all Openshift Enterprise versions using the openshift elasticsearch plugin.Red Hat OpenShift
- CVE-2017-15125A flaw was found in CloudForms before 5.9.0.22 in the self-service UI snapshot feature where the name field is not properly sanitized for HTRed Hat cloudforms
- CVE-2017-7497The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user.[UNKNOWN] CFME
- CVE-2017-2666It was discovered in Undertow that the code that parsed the HTTP request line permitted invalid characters.[UNKNOWN] undertow · io.undertow:undertow-core
- CVE-2017-7519In Ceph, a format string flaw was found in the way libradosstriper parses input from user.[UNKNOWN] ceph
- CVE-2018-10862WildFly Core before version 6.0.0.Alpha3 does not properly validate file paths in .war archives, allowing for the extraction of crafted .warorg.wildfly.core:wildfly-server
- CVE-2017-2622An accessibility flaw was found in the OpenStack Workflow (mistral) service where a service log directory was improperly made world readable[UNKNOWN] openstack-mistral
- CVE-2017-2639It was found that CloudForms does not verify that the server hostname matches the domain name in the certificate when using a custom CA and [UNKNOWN] CloudForms
- CVE-2017-7470It was found that spacewalk-channel can be used by a non-admin user or disabled users to perform administrative tasks due to an incorrect au[UNKNOWN] spacewalk-backend
- CVE-2018-14609An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14610An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14611An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14612An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14613An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14614An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14615An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14616An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14617An issue was discovered in the Linux kernel through 4.17.10.
- CVE-2018-14601An issue was discovered in GitLab Community and Enterprise Edition 11.1.x before 11.1.2.
- CVE-2018-14602An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2.
- CVE-2018-14603An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2.
- CVE-2018-14604An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2.
- CVE-2018-14605An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2.
- CVE-2018-14606An issue was discovered in GitLab Community and Enterprise Edition before 10.8.7, 11.0.x before 11.0.5, and 11.1.x before 11.1.2.