# CVEs published 2016-12-09

19 CVEs were published on December 9, 2016: 0 critical, 3 high. Days are UTC.

- [CVE-2016-5423](https://cve.now/CVE-2016-5423.md): PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated… (no CVSS)
- [CVE-2016-5424](https://cve.now/CVE-2016-5424.md): PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote… (no CVSS)
- [CVE-2016-6321](https://cve.now/CVE-2016-6321.md): Directory traversal vulnerability in the safer\_name\_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an… (CVSS 7.5)
- [CVE-2016-6496](https://cve.now/CVE-2016-6496.md): The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via… (no CVSS)
- [CVE-2016-6501](https://cve.now/CVE-2016-6501.md): JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java… (no CVSS)
- [CVE-2016-9101](https://cve.now/CVE-2016-9101.md): Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory… (no CVSS)
- [CVE-2016-9102](https://cve.now/CVE-2016-9102.md): Memory leak in the v9fs\_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a… (no CVSS)
- [CVE-2016-9103](https://cve.now/CVE-2016-9103.md): The v9fs\_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host… (no CVSS)
- [CVE-2016-9104](https://cve.now/CVE-2016-9104.md): Multiple integer overflows in the (1) v9fs\_xattr\_read and (2) v9fs\_xattr\_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator)… (no CVSS)
- [CVE-2016-9105](https://cve.now/CVE-2016-9105.md): Memory leak in the v9fs\_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial… (no CVSS)
- [CVE-2016-9106](https://cve.now/CVE-2016-9106.md): Memory leak in the v9fs\_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial… (no CVSS)
- [CVE-2015-8786](https://cve.now/CVE-2015-8786.md): The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service… (no CVSS)
- [CVE-2016-6301](https://cve.now/CVE-2016-6301.md): The recv\_and\_process\_client\_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and… (CVSS 7.5)
- [CVE-2016-6523](https://cve.now/CVE-2016-6523.md): Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject… (no CVSS)
- [CVE-2016-6829](https://cve.now/CVE-2016-6829.md): The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and… (no CVSS)
- [CVE-2016-9013](https://cve.now/CVE-2016-9013.md): Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created… (no CVSS, django)
- [CVE-2016-9014](https://cve.now/CVE-2016-9014.md): Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to… (no CVSS, django)
- [CVE-2016-9832](https://cve.now/CVE-2016-9832.md): PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and… (no CVSS)
- [CVE-2016-8858](https://cve.now/CVE-2016-8858.md): The kex\_input\_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory… (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2016-12-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.