# CVEs published 2016-06-01

17 CVEs were published on June 1, 2016: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-8875](https://cve.now/CVE-2015-8875.md): Multiple integer overflows in the (1) pixops\_composite\_nearest, (2) pixops\_composite\_color\_nearest, and (3) pixops\_process functions in… (no CVSS)
- [CVE-2016-1902](https://cve.now/CVE-2016-1902.md): The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly… (no CVSS, symfony/security-core · symfony/security +1)
- [CVE-2016-4423](https://cve.now/CVE-2016-4423.md): The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before… (no CVSS, symfony/security-http · symfony/security +1)
- [CVE-2016-4453](https://cve.now/CVE-2016-4453.md): The vmsvga\_fifo\_run function in hw/display/vmware\_vga.c in QEMU allows local guest OS administrators to cause a denial of service… (no CVSS)
- [CVE-2016-4454](https://cve.now/CVE-2016-4454.md): The vmsvga\_fifo\_read\_raw function in hw/display/vmware\_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory… (no CVSS)
- [CVE-2016-4810](https://cve.now/CVE-2016-4810.md): Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1 (CU1), and Citrix XenApp 7.5 and 7.6 allow… (no CVSS)
- [CVE-2016-4945](https://cve.now/CVE-2016-4945.md): Cross-site scripting (XSS) vulnerability in vpn/js/gateway\_login\_form\_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows… (no CVSS)
- [CVE-2016-5126](https://cve.now/CVE-2016-5126.md): Heap-based buffer overflow in the iscsi\_aio\_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of… (no CVSS)
- [CVE-2016-1234](https://cve.now/CVE-2016-1234.md): Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB\_ALTDIRFUNC is used, allows… (no CVSS)
- [CVE-2016-2175](https://cve.now/CVE-2016-2175.md): Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to… (no CVSS, org.apache.pdfbox:pdfbox)
- [CVE-2016-3075](https://cve.now/CVE-2016-3075.md): Stack-based buffer overflow in the nss\_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows… (no CVSS)
- [CVE-2016-3088](https://cve.now/CVE-2016-3088.md): The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTT (CVSS 9.8, KEV, org.apache.activemq:activemq-client)
- [CVE-2016-3094](https://cve.now/CVE-2016-3094.md): PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers… (no CVSS, org.apache.qpid:qpid-broker)
- [CVE-2016-3697](https://cve.now/CVE-2016-3697.md): libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username… (no CVSS, github.com/opencontainers/runc)
- [CVE-2016-4432](https://cve.now/CVE-2016-4432.md): The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass… (no CVSS, org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol · org…)
- [CVE-2016-0288](https://cve.now/CVE-2016-0288.md): IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to… (no CVSS)
- [CVE-2016-4500](https://cve.now/CVE-2016-4500.md): Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-06-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.