2016 CVEs (page 38)
Page 38 of 94 — CVEs published in 2016, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2016-6770 | Low | 3.3 | 2017-01-12 | An elevation of privilege vulnerability in the Framework API could enable a local malicious application to access system functions beyond its access level. Thi… |
CVE-2016-6769 | Medium | 4.6 | 2017-01-12 | An elevation of privilege vulnerability in Smart Lock could enable a local malicious user to access Smart Lock settings without a PIN. This issue is rated as M… |
CVE-2016-6768 | High | 7.8 | 2017-01-12 | A remote code execution vulnerability in the Framesequence library could enable an attacker using a specially crafted file to execute arbitrary code in the con… |
CVE-2016-6767 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated… |
CVE-2016-6766 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in libmedia and libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang… |
CVE-2016-6765 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in libstagefright in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. T… |
CVE-2016-6764 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in Mediaserver could enable an attacker to use a specially crafted file to cause a device hang or reboot. This issue is rated… |
CVE-2016-6763 | Medium | 5.5 | 2017-01-12 | A denial of service vulnerability in Telephony could enable a local malicious application to use a specially crafted file to cause a device hang or reboot. Thi… |
CVE-2016-6762 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in the libziparchive library could enable a local malicious application to execute arbitrary code within the context of… |
CVE-2016-6761 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6760 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6759 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6758 | High | 7.8 | 2017-01-12 | An elevation of privilege vulnerability in Qualcomm media codecs could enable a local malicious application to execute arbitrary code within the context of a p… |
CVE-2016-6757 | Medium | 4.7 | 2017-01-12 | An information disclosure vulnerability in Qualcomm components including the camera driver and video driver could enable a local malicious application to acces… |
CVE-2016-6756 | Medium | 4.7 | 2017-01-12 | An information disclosure vulnerability in Qualcomm components including the camera driver and video driver could enable a local malicious application to acces… |
CVE-2016-6755 | High | 7.0 | 2017-01-12 | An elevation of privilege vulnerability in the Qualcomm camera driver could enable a local malicious application to execute arbitrary code within the context o… |
CVE-2016-9444 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion fai… |
CVE-2016-9147 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.9.9-P4, 9.9.9-S6, 9.10.4-P4, and 9.11.0-P1 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a r… |
CVE-2016-9131 | High | 7.5 | 2017-01-12 | named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion fai… |
CVE-2016-10131 | Critical | 9.8 | 2017-01-12 | system/libraries/Email.php in CodeIgniter before 3.1.3 allows remote attackers to execute arbitrary code by leveraging control over the email->from field to in… |
CVE-2016-7479 | Critical | 9.8 | 2017-01-12 | In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote… |
CVE-2016-9015 | Low | 3.7 | 2017-01-11 | Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS… |
CVE-2016-6820 | High | 7.5 | 2017-01-11 | MetroCluster Tiebreaker for clustered Data ONTAP in versions before 1.2 discloses sensitive information in cleartext which may be viewed by an unauthenticated… |
CVE-2016-4808 | High | 8.8 | 2017-01-11 | Web2py versions 2.14.5 and below was affected by CSRF (Cross Site Request Forgery) vulnerability, which allows an attacker to trick a logged in user to perform… |
CVE-2016-4807 | Medium | 4.8 | 2017-01-11 | Web2py versions 2.14.5 and below was affected by Reflected XSS vulnerability, which allows an attacker to perform an XSS attack on logged in user (admin). |
CVE-2016-4806 | High | 7.5 | 2017-01-11 | Web2py versions 2.14.5 and below was affected by Local File Inclusion vulnerability, which allows a malicious intended user to read/access web server sensitive… |
CVE-2016-7480 | Critical | 9.8 | 2017-01-11 | The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote att… |
CVE-2016-7478 | High | 7.5 | 2017-01-11 | Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a cra… |
CVE-2016-9247 | Medium | 5.9 | 2017-01-10 | Under certain conditions for BIG-IP systems using a virtual server with an associated FastL4 profile and TCP analytics profile, a specific sequence of packets… |
CVE-2016-6837 | Medium | 6.1 | 2017-01-10 | Cross-site scripting (XSS) vulnerability in MantisBT Filter API in MantisBT versions before 1.2.19, and versions 2.0.0-beta1, 1.3.0-beta1 allows remote attacke… |
CVE-2016-6831 | High | 7.5 | 2017-01-10 | The "process-execute" and "process-spawn" procedures did not free memory correctly when the execve() call failed, resulting in a memory leak. This could be abu… |
CVE-2016-6830 | Critical | 9.8 | 2017-01-10 | The "process-execute" and "process-spawn" procedures in CHICKEN Scheme used fixed-size buffers for holding the arguments and environment variables to use in it… |
CVE-2016-6581 | High | 7.5 | 2017-01-10 | A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifi… |
CVE-2016-6580 | High | 7.5 | 2017-01-10 | A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer… |
CVE-2016-6287 | High | 7.5 | 2017-01-10 | The "http-client" egg always used a HTTP_PROXY environment variable to determine whether HTTP traffic should be routed via a proxy, even when running as a CGI… |
CVE-2016-6286 | High | 7.5 | 2017-01-10 | The "spiffy-cgi-handlers" egg would convert a nonexistent "Proxy" header to the HTTP_PROXY environment variable, which would allow attackers to direct CGI prog… |
CVE-2016-10126 | Critical | 9.8 | 2017-01-10 | Splunk Web in Splunk Enterprise 5.0.x before 5.0.17, 6.0.x before 6.0.13, 6.1.x before 6.1.12, 6.2.x before 6.2.12, 6.3.x before 6.3.8, and 6.4.x before 6.4.4… |
CVE-2016-8106 | Medium | 5.9 | 2017-01-09 | A Denial of Service in Intel Ethernet Controller's X710/XL710 with Non-Volatile Memory Images before version 5.05 allows a remote attacker to stop the controll… |
CVE-2016-10125 | High | 8.1 | 2017-01-09 | D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, which allows man-in-the-middle attackers to spoof devices by hijacking a… |
CVE-2016-10124 | High | 8.6 | 2017-01-09 | An issue was discovered in Linux Containers (LXC) before 2016-02-22. When executing a program via lxc-attach, the nonpriv session can escape to the parent sess… |
CVE-2016-9885 | Critical | 9.8 | 2017-01-06 | An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1. The gfsh (Geode Shell) endpoint, used by op… |
CVE-2016-9879 | High | 7.5 | 2017-01-06 | An issue was discovered in Pivotal Spring Security before 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1. Spring Security does not consider URL path parame… |
CVE-2016-9869 | Medium | 5.5 | 2017-01-06 | An issue was discovered in EMC ScaleIO versions before 2.0.1.1. Incorrect permissions on the SCINI driver may allow a low-privileged local attacker to modify t… |
CVE-2016-9868 | Medium | 5.5 | 2017-01-06 | An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may cause a denial-of-service by generating a kernel panic in t… |
CVE-2016-9867 | High | 8.8 | 2017-01-06 | An issue was discovered in EMC ScaleIO versions before 2.0.1.1. A low-privileged local attacker may be able to modify the kernel memory in the SCINI driver and… |
CVE-2016-8706 | High | 8.1 | 2017-01-06 | An integer overflow in process_bin_sasl_auth function in Memcached, which is responsible for authentication commands of Memcached binary protocol, can be abuse… |
CVE-2016-8705 | Critical | 9.8 | 2017-01-06 | Multiple integer overflows in process_bin_update function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol, can… |
CVE-2016-8704 | Critical | 9.8 | 2017-01-06 | An integer overflow in the process_bin_append_prepend function in Memcached, which is responsible for processing multiple commands of Memcached binary protocol… |
CVE-2016-8334 | Medium | 6.8 | 2017-01-06 | A large out-of-bounds read on the heap vulnerability in Foxit PDF Reader can potentially be abused for information disclosure. Combined with another vulnerabil… |
CVE-2016-5684 | High | 7.8 | 2017-01-06 | An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can caus… |
CVE-2016-5652 | High | 7.0 | 2017-01-06 | An exploitable heap-based buffer overflow exists in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to a heap-based bu… |
CVE-2016-5646 | High | 7.8 | 2017-01-06 | An exploitable heap overflow vulnerability exists in the Compound Binary File Format (CBFF) parser functionality of Lexmark Perceptive Document Filters library… |
CVE-2016-4336 | Critical | 9.8 | 2017-01-06 | An exploitable out-of-bounds write exists in the Bzip2 parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted Bzip2 document c… |
CVE-2016-4335 | High | 8.4 | 2017-01-06 | An exploitable buffer overflow exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted XLS document can lead… |
CVE-2016-4329 | Medium | 5.5 | 2017-01-06 | A local denial of service vulnerability exists in window broadcast message handling functionality of Kaspersky Anti-Virus software. Sending certain unhandled w… |
CVE-2016-4323 | Low | 3.7 | 2017-01-06 | A directory traversal exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially result in an ov… |
CVE-2016-4307 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the IOCTL handling functionality of Kaspersky Internet Security KL1 driver. A specially crafted IOCTL signal can ca… |
CVE-2016-4306 | Medium | 5.5 | 2017-01-06 | Multiple information leaks exist in various IOCTL handlers of the Kaspersky Internet Security KLDISK driver. Specially crafted IOCTL requests can cause the dri… |
CVE-2016-4305 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of Kaspersky Internet Security KLIF driver. A specially crafted native api call… |
CVE-2016-4304 | Medium | 5.5 | 2017-01-06 | A denial of service vulnerability exists in the syscall filtering functionality of the Kaspersky Internet Security KLIF driver. A specially crafted native api… |
CVE-2016-4298 | High | 7.8 | 2017-01-06 | When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a list of ele… |
CVE-2016-4296 | High | 7.8 | 2017-01-06 | When opening a Hangul Hcell Document (.cell) and processing a record that uses the CSSValFormat object, Hancom Office 2014 will search for an underscore ("_")… |
CVE-2016-4295 | High | 7.8 | 2017-01-06 | When opening a Hangul Hcell Document (.cell) and processing a particular record within the Workbook stream, an index miscalculation leading to a heap overlow c… |
CVE-2016-4294 | High | 7.8 | 2017-01-06 | When opening a Hangul Hcell Document (.cell) and processing a property record within the Workbook stream, Hancom Office 2014 will attempt to allocate space for… |
CVE-2016-4292 | High | 7.8 | 2017-01-06 | When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a static size to allocate a heap buffer… |
CVE-2016-4291 | High | 7.8 | 2017-01-06 | When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will use a field from the structure in an operat… |
CVE-2016-4290 | High | 7.8 | 2017-01-06 | When opening a Hangul HShow Document (.hpt) and processing a structure within the document, Hancom Office 2014 will attempt to allocate space for a block of da… |
CVE-2016-4288 | High | 8.4 | 2017-01-06 | A local privilege escalation vulnerability exists in BlueStacks App Player. The BlueStacks App Player installer creates a registry key with weak permissions th… |
CVE-2016-2380 | Low | 3.1 | 2017-01-06 | An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent to the server could potentially result in an out-of… |
CVE-2016-2378 | High | 8.1 | 2017-01-06 | A buffer overflow vulnerability exists in the handling of the MXIT protocol Pidgin. Specially crafted data sent via the server could potentially result in a bu… |
CVE-2016-2377 | High | 8.1 | 2017-01-06 | A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent by the server could potentially result… |
CVE-2016-2376 | High | 8.1 | 2017-01-06 | A buffer overflow vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially resul… |
CVE-2016-2375 | Medium | 5.3 | 2017-01-06 | An exploitable out-of-bounds read exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT contact information sent from the server can re… |
CVE-2016-2374 | High | 8.1 | 2017-01-06 | An exploitable memory corruption vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT MultiMX message sent via the serve… |
CVE-2016-2373 | Medium | 5.9 | 2017-01-06 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially resu… |
CVE-2016-2372 | Medium | 5.9 | 2017-01-06 | An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-o… |
CVE-2016-2371 | High | 8.1 | 2017-01-06 | An out-of-bounds write vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could cause memory… |
CVE-2016-2370 | Medium | 5.9 | 2017-01-06 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent from the server could potentially res… |
CVE-2016-2369 | Medium | 5.9 | 2017-01-06 | A NULL pointer dereference vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potential… |
CVE-2016-2368 | High | 8.1 | 2017-01-06 | Multiple memory corruption vulnerabilities exist in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could result i… |
CVE-2016-2367 | Medium | 5.9 | 2017-01-06 | An information leak exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially result in an out-o… |
CVE-2016-2366 | Medium | 5.9 | 2017-01-06 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially resu… |
CVE-2016-2365 | Medium | 5.9 | 2017-01-06 | A denial of service vulnerability exists in the handling of the MXIT protocol in Pidgin. Specially crafted MXIT data sent via the server could potentially resu… |
CVE-2016-2339 | Critical | 9.8 | 2017-01-06 | An exploitable heap overflow vulnerability exists in the Fiddle::Function.new "initialize" function functionality of Ruby. In Fiddle::Function.new "initialize"… |
CVE-2016-2337 | Critical | 9.8 | 2017-01-06 | Type confusion exists in _cancel_eval Ruby's TclTkIp class method. Attacker passing different type of object than String as "retval" argument can cause arbitra… |
CVE-2016-2336 | Critical | 9.8 | 2017-01-06 | Type confusion exists in two methods of Ruby's WIN32OLE class, ole_invoke and ole_query_interface. Attacker passing different type of object than this assumed… |
CVE-2016-1550 | Medium | 5.3 | 2017-01-06 | An exploitable vulnerability exists in the message authentication functionality of libntp in ntp 4.2.8p4 and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f92. A… |
CVE-2016-1549 | Medium | 6.5 | 2017-01-06 | A malicious authenticated peer can create arbitrarily-many ephemeral associations in order to win the clock selection algorithm in ntpd in NTP 4.2.8p4 and earl… |
CVE-2016-1548 | High | 7.2 | 2017-01-06 | An attacker can spoof a packet from a legitimate ntpd server with an origin timestamp that matches the peer->dst timestamp recorded for that server. After maki… |
CVE-2016-1547 | Medium | 5.3 | 2017-01-06 | An off-path attacker can cause a preemptible client association to be demobilized in NTP 4.2.8p4 and earlier and NTPSec a5fb34b9cc89b92a8fef2f459004865c93bb7f9… |
CVE-2016-8006 | Medium | 4.4 | 2017-01-05 | Authentication bypass vulnerability in Enterprise Security Manager (ESM) and License Manager (LM) in Intel Security McAfee Security Information and Event Manag… |
CVE-2016-6892 | High | 7.5 | 2017-01-05 | The x509FreeExtensions function in MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (free of unallocated memory) via a crafted X.509… |
CVE-2016-6891 | High | 7.5 | 2017-01-05 | MatrixSSL before 3.8.6 allows remote attackers to cause a denial of service (out-of-bounds read) via a crafted ASN.1 Bit Field primitive in an X.509 certificat… |
CVE-2016-6890 | Critical | 9.8 | 2017-01-05 | Heap-based buffer overflow in MatrixSSL before 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate. |
CVE-2016-9754 | High | 7.8 | 2017-01-05 | The ring_buffer_resize function in kernel/trace/ring_buffer.c in the profiling subsystem in the Linux kernel before 4.6.1 mishandles certain integer calculatio… |
CVE-2016-10030 | High | 8.1 | 2017-01-05 | The _prolog_error function in slurmd/req.c in Slurm before 15.08.13, 16.x before 16.05.7, and 17.x before 17.02.0-pre4 has a vulnerability in how the slurmd da… |
CVE-2016-7169 | Medium | 6.3 | 2017-01-05 | Directory traversal vulnerability in the File_Upload_Upgrader class in wp-admin/includes/class-file-upload-upgrader.php in the upgrade package uploader in Word… |
CVE-2016-7168 | Medium | 4.8 | 2017-01-05 | Cross-site scripting (XSS) vulnerability in the media_handle_upload function in wp-admin/includes/media.php in WordPress before 4.6.1 might allow remote attack… |
CVE-2016-10012 | High | 7.8 | 2017-01-05 | The shared memory manager (associated with pre-authentication compression) in sshd in OpenSSH before 7.4 does not ensure that a bounds check is enforced by all… |
CVE-2016-10011 | Medium | 6.2 | 2017-01-05 | authfile.c in sshd in OpenSSH before 7.4 does not properly consider the effects of realloc on buffer contents, which might allow local users to obtain sensitiv… |