# CVEs published 2015-12-16

38 CVEs were published on December 16, 2015: 0 critical, 1 high. Days are UTC.

- [CVE-2015-5304](https://cve.now/CVE-2015-5304.md): Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows… (no CVSS)
- [CVE-2015-8357](https://cve.now/CVE-2015-8357.md): Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary… (no CVSS)
- [CVE-2015-8358](https://cve.now/CVE-2015-8358.md): Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and… (no CVSS)
- [CVE-2015-8476](https://cve.now/CVE-2015-8476.md): Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in… (no CVSS, phpmailer/phpmailer)
- [CVE-2015-8562](https://cve.now/CVE-2015-8562.md): Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via… (no CVSS)
- [CVE-2015-8563](https://cve.now/CVE-2015-8563.md): Cross-site request forgery (CSRF) vulnerability in the com\_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6… (no CVSS)
- [CVE-2015-8564](https://cve.now/CVE-2015-8564.md): Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal… (no CVSS)
- [CVE-2015-8565](https://cve.now/CVE-2015-8565.md): Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact… (no CVSS)
- [CVE-2015-8566](https://cve.now/CVE-2015-8566.md): The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values. (no CVSS, joomla/session)
- [CVE-2015-8580](https://cve.now/CVE-2015-8580.md): Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit… (no CVSS)
- [CVE-2015-8577](https://cve.now/CVE-2015-8577.md): The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute… (no CVSS)
- [CVE-2015-8578](https://cve.now/CVE-2015-8578.md): AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode… (no CVSS)
- [CVE-2015-8579](https://cve.now/CVE-2015-8579.md): Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when… (no CVSS)
- [CVE-2015-6425](https://cve.now/CVE-2015-6425.md): The WebApplications Identity Management subsystem in Cisco Unified Communications Manager 10.5(0.98000.88) allows remote attackers to… (no CVSS)
- [CVE-2015-8000](https://cve.now/CVE-2015-8000.md): db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE… (no CVSS)
- [CVE-2015-8461](https://cve.now/CVE-2015-8461.md): Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a… (no CVSS)
- [CVE-2015-7201](https://cve.now/CVE-2015-7201.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote… (no CVSS)
- [CVE-2015-7202](https://cve.now/CVE-2015-7202.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of… (no CVSS)
- [CVE-2015-7203](https://cve.now/CVE-2015-7203.md): Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0… (no CVSS)
- [CVE-2015-7204](https://cve.now/CVE-2015-7204.md): Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2015-7205](https://cve.now/CVE-2015-7205.md): Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might… (no CVSS)
- [CVE-2015-7207](https://cve.now/CVE-2015-7207.md): Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers… (no CVSS)
- [CVE-2015-7208](https://cve.now/CVE-2015-7208.md): Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive… (no CVSS)
- [CVE-2015-7210](https://cve.now/CVE-2015-7210.md): Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary… (no CVSS)
- [CVE-2015-7211](https://cve.now/CVE-2015-7211.md): Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via… (no CVSS)
- [CVE-2015-7212](https://cve.now/CVE-2015-7212.md): Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR… (no CVSS)
- [CVE-2015-7213](https://cve.now/CVE-2015-7213.md): Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and… (no CVSS)
- [CVE-2015-7214](https://cve.now/CVE-2015-7214.md): Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and… (no CVSS)
- [CVE-2015-7215](https://cve.now/CVE-2015-7215.md): The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same… (no CVSS)
- [CVE-2015-7216](https://cve.now/CVE-2015-7216.md): The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows… (no CVSS)
- [CVE-2015-7217](https://cve.now/CVE-2015-7217.md): The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows… (no CVSS)
- [CVE-2015-7218](https://cve.now/CVE-2015-7218.md): The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow… (no CVSS)
- [CVE-2015-7219](https://cve.now/CVE-2015-7219.md): The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow… (no CVSS)
- [CVE-2015-7220](https://cve.now/CVE-2015-7220.md): Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause… (no CVSS)
- [CVE-2015-7221](https://cve.now/CVE-2015-7221.md): Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote… (no CVSS)
- [CVE-2015-7222](https://cve.now/CVE-2015-7222.md): Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x… (no CVSS)
- [CVE-2015-7223](https://cve.now/CVE-2015-7223.md): The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information… (no CVSS)
- [CVE-2015-8370](https://cve.now/CVE-2015-8370.md): Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive… (CVSS 7.4)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2015-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.