# CVEs published 2017-02-09

52 CVEs were published on February 9, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-5589](https://cve.now/CVE-2017-5589.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5590](https://cve.now/CVE-2017-5590.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5591](https://cve.now/CVE-2017-5591.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS, sleekxmpp · slixmpp)
- [CVE-2017-5592](https://cve.now/CVE-2017-5592.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5593](https://cve.now/CVE-2017-5593.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5602](https://cve.now/CVE-2017-5602.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5603](https://cve.now/CVE-2017-5603.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5604](https://cve.now/CVE-2017-5604.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5605](https://cve.now/CVE-2017-5605.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS, movim/moxl)
- [CVE-2017-5606](https://cve.now/CVE-2017-5606.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS)
- [CVE-2017-5858](https://cve.now/CVE-2017-5858.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user… (no CVSS, converse.js)
- [CVE-2017-5941](https://cve.now/CVE-2017-5941.md): An issue was discovered in the node-serialize package 0.0.4 for Node.js. (no CVSS, node-serialize)
- [CVE-2017-5180](https://cve.now/CVE-2017-5180.md): Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent… (no CVSS)
- [CVE-2017-5940](https://cve.now/CVE-2017-5940.md): Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to… (no CVSS)
- [CVE-2017-3807](https://cve.now/CVE-2017-3807.md): A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases… (no CVSS, Cisco ASA Software with Clientless SSL VPN portal is enable…)
- [CVE-2017-3813](https://cve.now/CVE-2017-3813.md): A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an… (no CVSS, Cisco AnyConnect Secure Mobility Client Software for Window…)
- [CVE-2017-5634](https://cve.now/CVE-2017-5634.md): The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select… (no CVSS)
- [CVE-2015-6023](https://cve.now/CVE-2015-6023.md): ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01\_R05 allows remote attackers to… (no CVSS)
- [CVE-2015-6024](https://cve.now/CVE-2015-6024.md): ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01\_R05 allows remote authenticated… (no CVSS)
- [CVE-2015-8831](https://cve.now/CVE-2015-8831.md): Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web… (no CVSS)
- [CVE-2015-8832](https://cve.now/CVE-2015-8832.md): Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with… (no CVSS)
- [CVE-2015-8936](https://cve.now/CVE-2015-8936.md): Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2016-10190](https://cve.now/CVE-2016-10190.md): Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2… (no CVSS)
- [CVE-2016-10191](https://cve.now/CVE-2016-10191.md): Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before… (no CVSS)
- [CVE-2016-10192](https://cve.now/CVE-2016-10192.md): Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows… (no CVSS)
- [CVE-2016-10198](https://cve.now/CVE-2016-10198.md): The gst\_aac\_parse\_sink\_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote… (no CVSS)
- [CVE-2016-10199](https://cve.now/CVE-2016-10199.md): The qtdemux\_tag\_add\_str\_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to… (no CVSS)
- [CVE-2016-2147](https://cve.now/CVE-2016-2147.md): Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a… (no CVSS)
- [CVE-2016-2148](https://cve.now/CVE-2016-2148.md): Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via… (no CVSS)
- [CVE-2016-3101](https://cve.now/CVE-2016-3101.md): Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary… (no CVSS, org.jenkins-ci.plugins:extra-columns)
- [CVE-2016-3102](https://cve.now/CVE-2016-3102.md): The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a… (no CVSS, org.jenkins-ci.plugins:script-security)
- [CVE-2016-4986](https://cve.now/CVE-2016-4986.md): Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an… (no CVSS, org.tap4j:tap)
- [CVE-2016-4987](https://cve.now/CVE-2016-4987.md): Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories… (no CVSS, com.tupilabs.image\_gallery:image-gallery)
- [CVE-2016-4988](https://cve.now/CVE-2016-4988.md): Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject… (no CVSS, com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer)
- [CVE-2016-5726](https://cve.now/CVE-2016-5726.md): Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP… (no CVSS)
- [CVE-2016-5727](https://cve.now/CVE-2016-5727.md): LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP… (no CVSS)
- [CVE-2016-6171](https://cve.now/CVE-2016-6171.md): Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone… (no CVSS)
- [CVE-2016-6173](https://cve.now/CVE-2016-6173.md): NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone… (no CVSS)
- [CVE-2016-8494](https://cve.now/CVE-2016-8494.md): Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by… (no CVSS, Fortinet Connect)
- [CVE-2016-9244](https://cve.now/CVE-2016-9244.md): A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31… (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, G…)
- [CVE-2017-5837](https://cve.now/CVE-2017-5837.md): The gst\_riff\_create\_audio\_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote… (no CVSS)
- [CVE-2017-5838](https://cve.now/CVE-2017-5838.md): The gst\_date\_time\_new\_from\_iso8601\_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a… (no CVSS)
- [CVE-2017-5839](https://cve.now/CVE-2017-5839.md): The gst\_riff\_create\_audio\_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly… (no CVSS)
- [CVE-2017-5840](https://cve.now/CVE-2017-5840.md): The qtdemux\_parse\_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause… (no CVSS)
- [CVE-2017-5841](https://cve.now/CVE-2017-5841.md): The gst\_avi\_demux\_parse\_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to… (no CVSS)
- [CVE-2017-5842](https://cve.now/CVE-2017-5842.md): The html\_context\_handle\_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote… (no CVSS)
- [CVE-2017-5843](https://cve.now/CVE-2017-5843.md): Multiple use-after-free vulnerabilities in the (1) gst\_mini\_object\_unref, (2) gst\_tag\_list\_unref, and (3)… (no CVSS)
- [CVE-2017-5844](https://cve.now/CVE-2017-5844.md): The gst\_riff\_create\_audio\_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote… (no CVSS)
- [CVE-2017-5845](https://cve.now/CVE-2017-5845.md): The gst\_avi\_demux\_parse\_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to… (no CVSS)
- [CVE-2017-5846](https://cve.now/CVE-2017-5846.md): The gst\_asf\_demux\_process\_ext\_stream\_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows… (no CVSS)
- [CVE-2017-5847](https://cve.now/CVE-2017-5847.md): The gst\_asf\_demux\_process\_ext\_content\_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers… (no CVSS)
- [CVE-2017-5848](https://cve.now/CVE-2017-5848.md): The gst\_ps\_demux\_parse\_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-02-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.