Linux vulnerabilitiesAnd the versions its exploited flaws hit.
Linux is made by Oracle. We track 226 published vulnerabilities in it, across 13 versions. 7 of them are on the list of flaws known to be exploited, the newest added on 12 May 2023. If you run Linux, check your version against the exploited flaws below and patch those first.
The most recent Linux flaw added to the known-exploited list is CVE-2014-0196, on 12 May 2023. We keep watching the known-exploited list.
Which versions of Linux do the exploited flaws hit?
Each exploited flaw lists the versions it affects, as published by the vendor. Find your version, then patch.
- CVE-2014-0196Exploited list, 12 May 2023
Linux Kernel Race Condition Vulnerability
6 - CVE-2016-3427Exploited list, 12 May 2023
Oracle Java SE and JRockit Unspecified Vulnerability
567 - CVE-2014-3153Exploited list, 25 May 2022
Linux Kernel Privilege Escalation Vulnerability
56 - CVE-2014-7169Exploited list, 28 Jan 2022
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
456 - CVE-2014-6271Exploited list, 28 Jan 2022
GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
456 - CVE-2016-3715Exploited list, 3 Nov 2021
ImageMagick Arbitrary File Deletion Vulnerability
67 - CVE-2016-3718Exploited list, 3 Nov 2021
ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
67
Which Linux vulnerabilities are being exploited?
7 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 5.5Linux Kernel Race Condition Vulnerability
Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
- 9.8Oracle Java SE and JRockit Unspecified Vulnerability
Oracle Java SE and JRockit contains an unspecified vulnerability that allows remote attackers to affect confidentiality, integrity, and availability via vectors related to Java Management Extensions (JMX).
- 7.8Linux Kernel Privilege Escalation Vulnerability
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
- 9.8GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
- 9.8GNU Bourne-Again Shell (Bash) Arbitrary Code Execution Vulnerability
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute code.
- 5.5ImageMagick Arbitrary File Deletion Vulnerability
ImageMagick contains an unspecified vulnerability that could allow users to delete files by using ImageMagick's 'ephemeral' pseudo protocol, which deletes files after reading.
- 5.5ImageMagick Server-Side Request Forgery (SSRF) Vulnerability
ImageMagick contains an unspecified vulnerability that allows attackers to perform server-side request forgery (SSRF) via a crafted image.
Which Linux flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by...
- >99%
GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown...
- 98%CVE-2013-5211Medium
The monlist feature in ntp_request.c in ntpd in NTP before 4.2.7p26 allows remote attackers to cause a denial of service (traffic amplification) via forged (1) REQ_MON_GETLIST or (2) REQ_MON_GETLIST_1 requests, as...
- 95%CVE-2015-0235Critical
Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1)...
- 92%
Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to JMX.
- 89%CVE-2016-2776High
buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion...
- 80%CVE-2016-4553High
client_side.cc in Squid before 3.5.18 and 4.x before 4.0.10 does not properly ignore the Host header when absolute-URI is provided, which allows remote attackers to conduct cache-poisoning attacks via an HTTP request.
- 78%CVE-2016-4054High
Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) responses.
- 77%
The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) attacks via a crafted image.
- 75%
The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.
Running Linux? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
- Matched to
- Linux on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
We track 226 published vulnerabilities listed under the name Linux, across 13 versions. The most recent Linux flaw added to the known-exploited list is CVE-2014-0196, on 12 May 2023.
7 are on the list of flaws known to be exploited. The most recently added are CVE-2014-0196, CVE-2016-3427 and CVE-2014-3153.
Each flaw names its own versions, usually as ranges. The newest, CVE-2014-0196, affects 6. The versions for every exploited flaw are listed on this page.
Create a EdgeProtect account and track Linux. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.