Red Hat Enterprise Linux Scientific Computing
By the Year
In 2023 there have been 2 vulnerabilities in Red Hat Enterprise Linux Scientific Computing with an average score of 8.8 out of ten. Last year Enterprise Linux Scientific Computing had 8 security vulnerabilities published. If vulnerabilities keep coming in at the current rate, it appears that number of security vulnerabilities in Enterprise Linux Scientific Computing in 2023 could surpass last years number. However, the average CVE base score of the vulnerabilities in 2023 is greater by 1.06.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2023 | 2 | 8.80 |
| 2022 | 8 | 7.74 |
| 2021 | 0 | 0.00 |
| 2020 | 0 | 0.00 |
| 2019 | 37 | 6.53 |
| 2018 | 0 | 0.00 |
It may take a day or so for new Enterprise Linux Scientific Computing vulnerabilities to show up in the stats or in the list of recent security vulnerabilties. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Red Hat Enterprise Linux Scientific Computing Security Vulnerabilities
A vulnerability was found in WebKit
CVE-2019-8720
8.8 - High
- March 06, 2023
A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution. Improved memory handling addresses the multiple memory corruption issues.
Buffer Overflow
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
CVE-2022-4254
8.8 - High
- February 01, 2023
sssd: libsss_certmap fails to sanitise certificate data used in LDAP filters
LDAP Injection
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU
CVE-2022-0330
7.8 - High
- March 25, 2022
A random memory access flaw was found in the Linux kernel's GPU i915 kernel driver functionality in the way a user may run malicious code on the GPU. This flaw allows a local user to crash the system or escalate their privileges on the system.
Improper Preservation of Permissions
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization
CVE-2021-3656
8.8 - High
- March 04, 2022
A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. The flaw occurs when processing the VMCB (virtual machine control block) provided by the L1 guest to spawn/handle a nested guest (L2). Due to improper validation of the "virt_ext" field, this issue could allow a malicious L1 to disable both VMLOAD/VMSAVE intercepts and VLS (Virtual VMLOAD/VMSAVE) for the L2 guest. As a result, the L2 guest would be allowed to read/write physical pages of the host, resulting in a crash of the entire system, leak of sensitive data or potential guest-to-host escape.
AuthZ
The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "
CVE-2021-44142
8.8 - High
- February 21, 2022
The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.
Out-of-bounds Read
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication
CVE-2020-25719
7.2 - High
- February 18, 2022
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.
Race Condition
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches
CVE-2021-4091
7.5 - High
- February 18, 2022
A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of search requests, forcing the server to behave unexpectedly, and crash.
Double-free
A flaw was found in the way Samba maps domain users to local users
CVE-2020-25717
8.1 - High
- February 18, 2022
A flaw was found in the way Samba maps domain users to local users. An authenticated attacker could use this flaw to cause possible privilege escalation.
Improper Input Validation
A flaw was found in the way samba implemented SMB1 authentication
CVE-2016-2124
5.9 - Medium
- February 18, 2022
A flaw was found in the way samba implemented SMB1 authentication. An attacker could use this flaw to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.
authentification
A local privilege escalation vulnerability was found on polkit's pkexec utility
CVE-2021-4034
7.8 - High
- January 28, 2022
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters count correctly and ends trying to execute environment variables as commands. An attacker can leverage this by crafting environment variables in such a way it'll induce pkexec to execute arbitrary code. When successfully executed the attack can cause a local privilege escalation given unprivileged users administrative rights on the target machine.
Memory Corruption
Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79
CVE-2019-13748
6.5 - Medium
- December 10, 2019
Insufficient policy enforcement in developer tools in Google Chrome prior to 79.0.3945.79 allowed a local attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
AuthZ
Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79
CVE-2019-13750
6.5 - Medium
- December 10, 2019
Insufficient data validation in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass defense-in-depth measures via a crafted HTML page.
Improper Input Validation
Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79
CVE-2019-13749
6.5 - Medium
- December 10, 2019
Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79
CVE-2019-13728
8.8 - High
- December 10, 2019
Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Memory Corruption
Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79
CVE-2019-13746
6.5 - Medium
- December 10, 2019
Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79
CVE-2019-13744
6.5 - Medium
- December 10, 2019
Insufficient policy enforcement in cookies in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
Information Disclosure
Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79
CVE-2019-13725
8.8 - High
- December 10, 2019
Use-after-free in Bluetooth in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Dangling pointer
Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79
CVE-2019-13759
4.3 - Medium
- December 10, 2019
Incorrect security UI in interstitials in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79
CVE-2019-13757
4.3 - Medium
- December 10, 2019
Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79
CVE-2019-13756
4.3 - Medium
- December 10, 2019
Incorrect security UI in printing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79
CVE-2019-13755
4.3 - Medium
- December 10, 2019
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to disable extensions via a crafted HTML page.
Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79
CVE-2019-13753
6.5 - Medium
- December 10, 2019
Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Out-of-bounds Read
Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79
CVE-2019-13752
6.5 - Medium
- December 10, 2019
Out of bounds read in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Out-of-bounds Read
Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79
CVE-2019-13751
6.5 - Medium
- December 10, 2019
Uninitialized data in SQLite in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Use of Uninitialized Resource
Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79
CVE-2019-13763
4.3 - Medium
- December 10, 2019
Insufficient policy enforcement in payments in Google Chrome prior to 79.0.3945.79 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.
Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79
CVE-2019-13762
3.3 - Low
- December 10, 2019
Insufficient policy enforcement in downloads in Google Chrome on Windows prior to 79.0.3945.79 allowed a local attacker to spoof downloaded files via local code.
Improper Locking
Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79
CVE-2019-13761
4.3 - Medium
- December 10, 2019
Incorrect security UI in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79
CVE-2019-13758
4.3 - Medium
- December 10, 2019
Insufficient policy enforcement in navigation in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79
CVE-2019-13747
8.8 - High
- December 10, 2019
Uninitialized data in rendering in Google Chrome on Android prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Memory Corruption
Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79
CVE-2019-13742
6.5 - Medium
- December 10, 2019
Incorrect security UI in Omnibox in Google Chrome on iOS prior to 79.0.3945.79 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.
Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79
CVE-2019-13739
6.5 - Medium
- December 10, 2019
Insufficient policy enforcement in Omnibox in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via IDN homographs via a crafted domain name.
Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79
CVE-2019-13730
8.8 - High
- December 10, 2019
Type confusion in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Memory Corruption
Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79
CVE-2019-13743
6.5 - Medium
- December 10, 2019
Incorrect security UI in external protocol handling in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to spoof security UI via a crafted HTML page.
Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79
CVE-2019-13741
8.8 - High
- December 10, 2019
Insufficient validation of untrusted input in Blink in Google Chrome prior to 79.0.3945.79 allowed a local attacker to bypass same origin policy via crafted clipboard content.
XSS
Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79
CVE-2019-13740
6.5 - Medium
- December 10, 2019
Incorrect security UI in sharing in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to perform domain spoofing via a crafted HTML page.
Origin Validation Error
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79
CVE-2019-13754
4.3 - Medium
- December 10, 2019
Insufficient policy enforcement in extensions in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.
Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79
CVE-2019-13738
6.5 - Medium
- December 10, 2019
Insufficient policy enforcement in navigation in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass site isolation via a crafted HTML page.
Improper Privilege Management
Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79
CVE-2019-13737
6.5 - Medium
- December 10, 2019
Insufficient policy enforcement in autocomplete in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
Information Disclosure
Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79
CVE-2019-13736
8.8 - High
- December 10, 2019
Integer overflow in PDFium in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.
Memory Corruption
Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79
CVE-2019-13735
8.8 - High
- December 10, 2019
Out of bounds write in JavaScript in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
Memory Corruption
Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79
CVE-2019-13732
8.8 - High
- December 10, 2019
Use-after-free in WebAudio in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Memory Corruption
Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79
CVE-2019-13729
8.8 - High
- December 10, 2019
Use-after-free in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Memory Corruption
Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79
CVE-2019-13727
8.8 - High
- December 10, 2019
Insufficient policy enforcement in WebSockets in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to bypass same origin policy via a crafted HTML page.
Improper Preservation of Permissions
Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79
CVE-2019-13726
8.8 - High
- December 10, 2019
Buffer overflow in password manager in Google Chrome prior to 79.0.3945.79 allowed a remote attacker to execute arbitrary code via a crafted HTML page.
Buffer Overflow
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free
CVE-2019-7317
5.3 - Medium
- February 04, 2019
png_image_free in png.c in libpng 1.6.x before 1.6.37 has a use-after-free because png_image_free_function is called under png_safe_execute.
Dangling pointer
A denial of service vulnerability was found in rsyslog in the imptcp module
CVE-2018-16881
7.5 - High
- January 25, 2019
A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted message to the imptcp socket, which would cause rsyslog to crash. Versions before 8.27.0 are vulnerable.
Integer Overflow or Wraparound
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'
CVE-2018-16866
3.3 - Low
- January 11, 2019
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
Information Disclosure
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might
CVE-2015-3405
7.5 - High
- August 09, 2017
ntp-keygen in ntp 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines when the lowest order byte of the temp variable is between 0x20 and 0x7f and not #, which might allow remote attackers to obtain the value of generated MD5 keys via a brute force attack with the 93 possible keys.
Insufficient Entropy
openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045
CVE-2016-9675
7.8 - High
- December 22, 2016
openjpeg: A heap-based buffer overflow flaw was found in the patch for CVE-2013-6045. A crafted j2k image could cause the application to crash, or potentially execute arbitrary code.
Memory Corruption
The handle_command function in mon/Monitor.cc in Ceph
CVE-2016-5009
6.5 - Medium
- July 12, 2016
The handle_command function in mon/Monitor.cc in Ceph allows remote authenticated users to cause a denial of service (segmentation fault and ceph monitor crash) via an (1) empty or (2) crafted prefix.
Improper Input Validation
The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might
CVE-2015-3214
- August 31, 2015
The pit_ioport_read in i8254.c in the Linux kernel before 2.6.33 and QEMU before 2.3.1 does not distinguish between read lengths and write lengths, which might allow guest OS users to execute arbitrary code on the host OS by triggering use of an invalid index.
Buffer Overflow
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier
CVE-2015-5165
- August 12, 2015
The C+ mode offload emulation in the RTL8139 network card device model in QEMU, as used in Xen 4.5.x and earlier, allows remote attackers to read process heap memory via unspecified vectors.
Use of Uninitialized Resource
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier
CVE-2012-1717
- June 16, 2012
Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 update 4 and earlier, 6 update 32 and earlier, 5 update 35 and earlier, and 1.4.2_37 and earlier allows local users to affect confidentiality via unknown vectors related to printing on Solaris or Linux.
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for Suse Linux Enterprise Java or by Red Hat? Click the Watch button to subscribe.
