Redhat Linux vulnerabilities

CVE-2002-0836 [HIGH] CVE-2002-0836: dvips converter for Postscript files in the tetex package calls the system() function insecurely, wh dvips converter for Postscript files in the tetex package calls the system() function insecurely, which allows remote attackers to execute arbitrary commands via certain print jobs, possibly involving fonts.

CVE-2000-1134 [HIGH] CVE-2000-1134: Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, Multiple shell programs on various Unix systems, including (1) tcsh, (2) csh, (3) sh, and (4) bash, follow symlinks when processing << redirects (aka here-documents or in-here documents), which allows local users to overwrite files of other users via a symlink attack.

CVE-2000-0378 [HIGH] CVE-2000-0378: The pam_console PAM module in Linux systems performs a chown on various devices upon a user login, b The pam_console PAM module in Linux systems performs a chown on various devices upon a user login, but an open file descriptor for those devices can be maintained after the user logs out, which allows that user to sniff activity on these devices when subsequent users log in.

CVE-2001-0641 [MEDIUM] CVE-2001-0641: Buffer overflow in man program in various distributions of Linux allows local user to execute arbitr Buffer overflow in man program in various distributions of Linux allows local user to execute arbitrary code as group man via a long -S option.

CVE-2000-0508 [MEDIUM] CVE-2000-0508: rpc.lockd in Red Hat Linux 6.1 and 6.2 allows remote attackers to cause a denial of service via a ma rpc.lockd in Red Hat Linux 6.1 and 6.2 allows remote attackers to cause a denial of service via a malformed request.

CVE-1999-0804 [MEDIUM] CVE-1999-0804: Denial of service in Linux 2.2.x kernels via malformed ICMP packets containing unusual types, codes, Denial of service in Linux 2.2.x kernels via malformed ICMP packets containing unusual types, codes, and IP header lengths.

CVE-2001-0787 [MEDIUM] CVE-2001-0787: LPRng in Red Hat Linux 7.0 and 7.1 does not properly drop memberships in supplemental groups when lo LPRng in Red Hat Linux 7.0 and 7.1 does not properly drop memberships in supplemental groups when lowering privileges, which could allow a local user to elevate privileges.

CVE-2004-0902 [CRITICAL] CVE-2004-0902: Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release, Mozilla before 1 Multiple heap-based buffer overflows in Mozilla Firefox before the Preview Release, Mozilla before 1.7.3, and Thunderbird before 0.8 allow remote attackers to cause a denial of service (application crash) or execute arbitrary code via (1) the "Send page" functionality, (2) certain responses from a malicious POP3 server, or (3) a link containing a non-ASCII

CVE-2003-0041 [CRITICAL] CWE-78 CVE-2003-0041: Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a Kerberos FTP client allows remote FTP sites to execute arbitrary code via a pipe (|) character in a filename that is retrieved by the client.

CVE-1999-0814 [CRITICAL] CVE-1999-0814: Red Hat pump DHCP client allows remote attackers to gain root access in some configurations. Red Hat pump DHCP client allows remote attackers to gain root access in some configurations.

CVE-1999-0986 [MEDIUM] CVE-1999-0986: The ping command in Linux 2.0.3x allows local users to cause a denial of service by sending large pa The ping command in Linux 2.0.3x allows local users to cause a denial of service by sending large packets with the -R (record route) option.

CVE-2002-1814 [MEDIUM] CVE-2002-1814: Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrar Buffer overflow in efstools in Bonobo, when installed setuid, allows local users to execute arbitrary code via long command line arguments.

CVE-1999-1542 [CRITICAL] CVE-1999-1542: RPMMail before 1.4 allows remote attackers to execute commands via an e-mail message with shell meta RPMMail before 1.4 allows remote attackers to execute commands via an e-mail message with shell metacharacters in the "MAIL FROM" command.

CVE-2016-3699 [HIGH] CWE-264 CVE-2016-3699: The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when boot The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows local users to bypass intended Secure Boot restrictions and execute untrusted code by appending ACPI tables to the initrd.

CVE-1999-0433 [MEDIUM] CVE-1999-0433: XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in re XFree86 startx command is vulnerable to a symlink attack, allowing local users to create files in restricted directories, possibly allowing them to gain privileges or cause a denial of service.

CVE-2000-0816 [LOW] CVE-2000-0816: Linux tmpwatch --fuser option allows local users to execute arbitrary commands by creating files who Linux tmpwatch --fuser option allows local users to execute arbitrary commands by creating files whose names contain shell metacharacters.

CVE-2001-0439 [HIGH] CVE-2001-0439: licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in licq before 1.0.3 allows remote attackers to execute arbitrary commands via shell metacharacters in a URL.

CVE-2004-1333 [LOW] CVE-2004-1333: Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows loca Integer overflow in the vc_resize function in the Linux kernel 2.4 and 2.6 before 2.6.10 allows local users to cause a denial of service (kernel crash) via a short new screen value, which leads to a buffer overflow.

CVE-2001-0169 [LOW] CVE-2001-0169: When using the LD_PRELOAD environmental variable in SUID or SGID applications, glibc does not verify When using the LD_PRELOAD environmental variable in SUID or SGID applications, glibc does not verify that preloaded libraries in /etc/ld.so.cache are also SUID/SGID, which could allow a local user to overwrite arbitrary files by loading a library from /lib or /usr/lib.

CVE-2001-0170 [LOW] CVE-2001-0170: glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS e glibc 2.1.9x and earlier does not properly clear the RESOLV_HOST_CONF, HOSTALIASES, or RES_OPTIONS environmental variables when executing setuid/setgid programs, which could allow local users to read arbitrary files.