linux-ha vulnerabilities

Products

• heartbeat 3
• ha 1
• ocf resource agents 1

Latest linux-ha CVEs

Newest publication first

1. CVE-2015-1198 Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.

   Published 2017-08-28

   High·CVSS 7.5 EPSS 3.3%

   Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5.

2. CVE-2010-3389 The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows...

   Published 2010-10-20

   Medium·CVSS 6.9 EPSS 0.42%

   The (1) SAPDatabase and (2) SAPInstance scripts in OCF Resource Agents (aka resource-agents or cluster-agents) 1.0.3 in Linux-HA place a zero-length directory name in the LD_LIBRARY_PATH, which allows local users to gain privileges via a Trojan horse shared library in the current...

3. CVE-2007-4205 XHA (Linux-HA) on the BlueCat Networks Adonis DNS/DHCP Appliance 5.0.2.8 allows remote attackers to cause a denial of service (heartbeat control process crash) via a UDP packet to port 694. NOTE: this...

   Published 2007-08-08

   High·CVSS 7.1 EPSS 2.5%

   XHA (Linux-HA) on the BlueCat Networks Adonis DNS/DHCP Appliance 5.0.2.8 allows remote attackers to cause a denial of service (heartbeat control process crash) via a UDP packet to port 694. NOTE: this may be the same as CVE-2006-3121.

4. CVE-2006-3815 heartbeat.c in heartbeat before 2.0.6 sets insecure permissions in a shmget call for shared memory, which allows local users to cause an unspecified denial of service via unknown vectors, possibly dur...

   Published 2006-07-24

   Low·CVSS 2.1 EPSS 0.78%

   heartbeat.c in heartbeat before 2.0.6 sets insecure permissions in a shmget call for shared memory, which allows local users to cause an unspecified denial of service via unknown vectors, possibly during a short time window on startup.

5. CVE-2002-1215 Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier (claimed as buffer overflows in some sources) allow remote attackers to execute arbitrary code via certain packets to UDP port 694...

   Published 2002-10-21

   High·CVSS 10.0 EPSS 6.3%

   Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier (claimed as buffer overflows in some sources) allow remote attackers to execute arbitrary code via certain packets to UDP port 694 (incorrectly claimed as TCP in some sources).

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.