# CVEs published 2016-04-13

54 CVEs were published on April 13, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9655](https://cve.now/CVE-2014-9655.md): The (1) putcontig8bitYCbCr21tile function in tif\_getimage.c or (2) NeXTDecode function in tif\_next.c in LibTIFF allows remote attackers to… (no CVSS)
- [CVE-2015-1547](https://cve.now/CVE-2015-1547.md): The NeXTDecode function in tif\_next.c in LibTIFF allows remote attackers to cause a denial of service (uninitialized memory access) via a… (no CVSS)
- [CVE-2015-3146](https://cve.now/CVE-2015-3146.md): The (1) SSH\_MSG\_NEWKEYS and (2) SSH\_MSG\_KEXDH\_REPLY packet handlers in package\_cb.c in libssh before 0.6.5 do not properly validate state… (no CVSS)
- [CVE-2015-8665](https://cve.now/CVE-2015-8665.md): tif\_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds read) via the SamplesPerPixel tag in a… (no CVSS)
- [CVE-2015-8683](https://cve.now/CVE-2015-8683.md): The putcontig8bitCIELab function in tif\_getimage.c in LibTIFF 4.0.6 allows remote attackers to cause a denial of service (out-of-bounds… (no CVSS)
- [CVE-2015-8784](https://cve.now/CVE-2015-8784.md): The NeXTDecode function in tif\_next.c in LibTIFF allows remote attackers to cause a denial of service (out-of-bounds write) via a crafted… (no CVSS)
- [CVE-2015-8806](https://cve.now/CVE-2015-8806.md): dict.c in libxml2 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via an… (no CVSS, nokogiri)
- [CVE-2016-0739](https://cve.now/CVE-2016-0739.md): libssh before 0.7.3 improperly truncates ephemeral secrets generated for the (1) diffie-hellman-group1 and (2) diffie-hellman-group14 key… (no CVSS)
- [CVE-2016-0757](https://cve.now/CVE-2016-0757.md): OpenStack Image Service (Glance) before 2015.1.3 (kilo) and 11.0.x before 11.0.2 (liberty), when show\_multiple\_locations is enabled, allow… (no CVSS, glance)
- [CVE-2016-0787](https://cve.now/CVE-2016-0787.md): The diffie\_hellman\_sha256 function in kex.c in libssh2 before 1.7.0 improperly truncates secrets to 128 or 256 bits, which makes it easier… (no CVSS)
- [CVE-2016-2313](https://cve.now/CVE-2016-2313.md): auth\_login.php in Cacti before 0.8.8g allows remote authenticated users who use web authentication to bypass intended access restrictions… (no CVSS)
- [CVE-2015-8807](https://cve.now/CVE-2015-8807.md): Cross-site scripting (XSS) vulnerability in the \_renderVarInput\_number function in… (no CVSS)
- [CVE-2016-0740](https://cve.now/CVE-2016-0740.md): Buffer overflow in the ImagingLibTiffDecode function in libImaging/TiffDecode.c in Pillow before 3.1.1 allows remote attackers to… (no CVSS, pillow)
- [CVE-2016-0775](https://cve.now/CVE-2016-0775.md): Buffer overflow in the ImagingFliDecode function in libImaging/FliDecode.c in Pillow before 3.1.1 allows remote attackers to cause a… (no CVSS, pillow)
- [CVE-2016-2054](https://cve.now/CVE-2016-2054.md): Multiple buffer overflows in xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to execute… (no CVSS)
- [CVE-2016-2055](https://cve.now/CVE-2016-2055.md): xymond/xymond.c in xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote attackers to read arbitrary files in the… (no CVSS)
- [CVE-2016-2056](https://cve.now/CVE-2016-2056.md): xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell… (no CVSS)
- [CVE-2016-2057](https://cve.now/CVE-2016-2057.md): lib/xymond\_ipc.c in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 use weak permissions (666) for an unspecified IPC message queue, which… (no CVSS)
- [CVE-2016-2058](https://cve.now/CVE-2016-2058.md): Multiple cross-site scripting (XSS) vulnerabilities in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow (1) remote Xymon clients to… (no CVSS)
- [CVE-2016-2084](https://cve.now/CVE-2016-2084.md): F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 build 685-HF10, 11.5.1 before build… (no CVSS)
- [CVE-2016-2191](https://cve.now/CVE-2016-2191.md): The bmp\_read\_rows function in pngxtern/pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service (invalid… (no CVSS)
- [CVE-2016-2228](https://cve.now/CVE-2016-2228.md): Cross-site scripting (XSS) vulnerability in horde/templates/topbar/\_menubar.html.php in Horde Groupware before 5.2.12 and Horde Groupware… (no CVSS)
- [CVE-2016-2515](https://cve.now/CVE-2016-2515.md): Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long… (no CVSS, hawk)
- [CVE-2016-2533](https://cve.now/CVE-2016-2533.md): Buffer overflow in the ImagingPcdDecode function in PcdDecode.c in Pillow before 3.1.1 and Python Imaging Library (PIL) 1.1.7 and earlier… (no CVSS, pillow)
- [CVE-2016-3068](https://cve.now/CVE-2016-3068.md): Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted git ext:: URL when cloning a subrepository. (no CVSS, mercurial)
- [CVE-2016-3069](https://cve.now/CVE-2016-3069.md): Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a crafted name when converting a Git repository. (no CVSS, mercurial)
- [CVE-2016-3158](https://cve.now/CVE-2016-3158.md): The xrstor function in arch/x86/xstate.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64… (no CVSS)
- [CVE-2016-3159](https://cve.now/CVE-2016-3159.md): The fpu\_fxrstor function in arch/x86/i387.c in Xen 4.x does not properly handle writes to the hardware FSW.ES bit when running on AMD64… (no CVSS)
- [CVE-2016-3630](https://cve.now/CVE-2016-3630.md): The binary delta decoder in Mercurial before 3.7.3 allows remote attackers to execute arbitrary code via a (1) clone, (2) push, or (3)… (no CVSS, mercurial)
- [CVE-2016-3686](https://cve.now/CVE-2016-3686.md): The Single Sign-On (SSO) feature in F5 BIG-IP APM 11.x before 11.6.0 HF6 and BIG-IP Edge Gateway 11.0.0 through 11.3.0 might allow remote… (no CVSS)
- [CVE-2016-3981](https://cve.now/CVE-2016-3981.md): Heap-based buffer overflow in the bmp\_read\_rows function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial… (no CVSS)
- [CVE-2016-3982](https://cve.now/CVE-2016-3982.md): Off-by-one error in the bmp\_rle4\_fread function in pngxrbmp.c in OptiPNG before 0.7.6 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-4009](https://cve.now/CVE-2016-4009.md): Integer overflow in the ImagingResampleHorizontal function in libImaging/Resample.c in Pillow before 3.1.1 allows remote attackers to have… (no CVSS, pillow)
- [CVE-2015-0861](https://cve.now/CVE-2015-0861.md): model/modelstorage.py in trytond 3.2.x before 3.2.10, 3.4.x before 3.4.8, 3.6.x before 3.6.5, and 3.8.x before 3.8.1 allows remote… (no CVSS, trytond)
- [CVE-2015-7545](https://cve.now/CVE-2015-7545.md): The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and… (no CVSS)
- [CVE-2015-7555](https://cve.now/CVE-2015-7555.md): Heap-based buffer overflow in giffix.c in giffix in giflib 5.1.1 allows attackers to cause a denial of service (program crash) via crafted… (no CVSS)
- [CVE-2015-8080](https://cve.now/CVE-2015-8080.md): Integer overflow in the getnum function in lua\_struct.c in Redis 2.8.x before 2.8.24 and 3.0.x before 3.0.6 allows context-dependent… (no CVSS)
- [CVE-2015-8551](https://cve.now/CVE-2015-8551.md): The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest… (no CVSS)
- [CVE-2015-8552](https://cve.now/CVE-2015-8552.md): The PCI backend driver in Xen, when running on an x86 system and using Linux 3.1.x through 4.3.x as the driver domain, allows local guest… (no CVSS)
- [CVE-2015-8553](https://cve.now/CVE-2015-8553.md): Xen allows guest OS users to obtain sensitive information from uninitialized locations in host OS kernel memory by not enabling memory and… (CVSS 6.5)
- [CVE-2015-8555](https://cve.now/CVE-2015-8555.md): Xen 4.6.x, 4.5.x, 4.4.x, 4.3.x, and earlier do not initialize x86 FPU stack and XMM registers when XSAVE/XRSTOR are not used to manage… (no CVSS)
- [CVE-2015-8606](https://cve.now/CVE-2015-8606.md): Multiple cross-site scripting (XSS) vulnerabilities in SilverStripe CMS & Framework before 3.1.16 and 3.2.x before 3.2.1 allow remote… (no CVSS, silverstripe/cms)
- [CVE-2015-8843](https://cve.now/CVE-2015-8843.md): The Foxit Cloud Update Service (FoxitCloudUpdateService) in Foxit Reader 6.1 through 6.2.x and 7.x before 7.2.2, when an update to the… (no CVSS)
- [CVE-2014-6276](https://cve.now/CVE-2014-6276.md): schema.py in Roundup before 1.5.1 does not properly limit attributes included in default user permissions, which might allow remote… (no CVSS, roundup)
- [CVE-2014-9766](https://cve.now/CVE-2014-9766.md): Integer overflow in the create\_bits function in pixman-bits-image.c in Pixman before 0.32.6 allows remote attackers to cause a denial of… (no CVSS)
- [CVE-2015-8304](https://cve.now/CVE-2015-8304.md): Integer overflow in Huawei P7 phones with software before P7-L07 V100R001C01B606 allows remote attackers to gain privileges via a crafted… (no CVSS)
- [CVE-2015-8620](https://cve.now/CVE-2015-8620.md): Heap-based buffer overflow in the Avast virtualization driver (aswSnx.sys) in Avast Internet Security, Pro Antivirus, Premier, and Free… (no CVSS)
- [CVE-2015-8682](https://cve.now/CVE-2015-8682.md): The Video0 driver in Huawei P8 smartphones with software GRA-UL00 before GRA-UL00C00B350, GRA-UL10 before GRA-UL10C00B350, GRA-TL00 before… (no CVSS)
- [CVE-2016-1495](https://cve.now/CVE-2016-1495.md): Integer overflow in the graphics drivers in Huawei Mate S smartphones with software CRR-TL00 before CRR-TL00C01B160SP01, CRR-UL00 before… (no CVSS)
- [CVE-2016-1496](https://cve.now/CVE-2016-1496.md): The graphics driver in Huawei P8 smartphones with software GRA-TL00 before GRA-TL00C01B230, GRA-CL00 before GRA-CL00C92B230, GRA-CL10… (no CVSS)
- [CVE-2016-1577](https://cve.now/CVE-2016-1577.md): Double free vulnerability in the jas\_iccattrval\_destroy function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial… (no CVSS)
- [CVE-2016-2116](https://cve.now/CVE-2016-2116.md): Memory leak in the jas\_iccprof\_createfrombuf function in JasPer 1.900.1 and earlier allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2016-2780](https://cve.now/CVE-2016-2780.md): Untrusted search path vulnerability in Huawei UTPS before UTPS-V200R003B015D15SP00C983 allows local users to execute arbitrary code and… (no CVSS)
- [CVE-2016-4007](https://cve.now/CVE-2016-4007.md): Multiple unspecified vulnerabilities in the obs-service-extract\_file package before 0.3-5.1 in openSUSE Leap 42.1 and before 0.3-3.1 in… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-04-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.