# CVEs published 2017-06-06

49 CVEs were published on June 6, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-9461](https://cve.now/CVE-2017-9461.md): smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd\_open\_atomic infinite loop with high CPU usage… (no CVSS)
- [CVE-2017-9462](https://cve.now/CVE-2017-9462.md): In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute… (no CVSS, mercurial)
- [CVE-2017-9465](https://cve.now/CVE-2017-9465.md): The yr\_arena\_write\_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application… (no CVSS)
- [CVE-2014-8180](https://cve.now/CVE-2014-8180.md): MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information… (no CVSS)
- [CVE-2015-1207](https://cve.now/CVE-2015-1207.md): Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service… (no CVSS)
- [CVE-2015-3830](https://cve.now/CVE-2015-3830.md): The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to… (no CVSS)
- [CVE-2016-0726](https://cve.now/CVE-2016-0726.md): The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier… (no CVSS)
- [CVE-2016-0767](https://cve.now/CVE-2016-0767.md): PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema… (no CVSS, postgresql:pljava-public)
- [CVE-2016-0768](https://cve.now/CVE-2016-0768.md): PostgreSQL PL/Java after 9.0 does not honor access controls on large objects. (no CVSS)
- [CVE-2016-2192](https://cve.now/CVE-2016-2192.md): PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own. (no CVSS)
- [CVE-2016-3066](https://cve.now/CVE-2016-3066.md): The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard. (no CVSS)
- [CVE-2016-3077](https://cve.now/CVE-2016-3077.md): The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process… (no CVSS)
- [CVE-2016-5004](https://cve.now/CVE-2016-5004.md): The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service… (no CVSS, org.apache.xmlrpc:xmlrpc-common)
- [CVE-2016-9960](https://cve.now/CVE-2016-9960.md): game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash). (no CVSS)
- [CVE-2016-9961](https://cve.now/CVE-2016-9961.md): game-music-emu before 0.6.1 mishandles unspecified integer values. (no CVSS)
- [CVE-2017-5243](https://cve.now/CVE-2017-5243.md): The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key… (no CVSS, Rapid7 Nexpose hardware appliance)
- [CVE-2017-8920](https://cve.now/CVE-2017-8920.md): irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS. (no CVSS)
- [CVE-2017-9451](https://cve.now/CVE-2017-9451.md): Cross site scripting (XSS) vulnerability in pages.edit\_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript… (no CVSS)
- [CVE-2017-9452](https://cve.now/CVE-2017-9452.md): Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script… (no CVSS)
- [CVE-2017-9448](https://cve.now/CVE-2017-9448.md): Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script… (no CVSS)
- [CVE-2017-9449](https://cve.now/CVE-2017-9449.md): SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via… (no CVSS)
- [CVE-2014-9923](https://cve.now/CVE-2014-9923.md): In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2014-9924](https://cve.now/CVE-2014-9924.md): In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur. (no CVSS, All Qualcomm products)
- [CVE-2014-9925](https://cve.now/CVE-2014-9925.md): In HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2014-9926](https://cve.now/CVE-2014-9926.md): In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9927](https://cve.now/CVE-2014-9927.md): In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2014-9928](https://cve.now/CVE-2014-9928.md): In GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2014-9929](https://cve.now/CVE-2014-9929.md): In WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially… (no CVSS, All Qualcomm products)
- [CVE-2014-9930](https://cve.now/CVE-2014-9930.md): In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9941](https://cve.now/CVE-2014-9941.md): In the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition… (no CVSS, All Qualcomm products)
- [CVE-2014-9942](https://cve.now/CVE-2014-9942.md): In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9943](https://cve.now/CVE-2014-9943.md): In Core Kernel in all Android releases from CAF using the Linux kernel, a Null Pointer Dereference vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9944](https://cve.now/CVE-2014-9944.md): In the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability… (no CVSS, All Qualcomm products)
- [CVE-2014-9945](https://cve.now/CVE-2014-9945.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9946](https://cve.now/CVE-2014-9946.md): In Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9947](https://cve.now/CVE-2014-9947.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9948](https://cve.now/CVE-2014-9948.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Validation of Array Index vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2014-9949](https://cve.now/CVE-2014-9949.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Untrusted Pointer Dereference vulnerability could potentially… (no CVSS, All Qualcomm products)
- [CVE-2014-9950](https://cve.now/CVE-2014-9950.md): In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9951](https://cve.now/CVE-2014-9951.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability… (no CVSS, All Qualcomm products)
- [CVE-2014-9952](https://cve.now/CVE-2014-9952.md): In the Secure File System in all Android releases from CAF using the Linux kernel, a capture-replay vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2015-9005](https://cve.now/CVE-2015-9005.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2015-9006](https://cve.now/CVE-2015-9006.md): In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2015-9007](https://cve.now/CVE-2015-9007.md): In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2016-10297](https://cve.now/CVE-2016-10297.md): In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could… (no CVSS, All Qualcomm products)
- [CVE-2017-5664](https://cve.now/CVE-2017-5664.md): The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-7515](https://cve.now/CVE-2017-7515.md): poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service. (no CVSS, Red Hat poppler)
- [CVE-2017-8083](https://cve.now/CVE-2017-8083.md): CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of… (no CVSS)
- [CVE-2017-9332](https://cve.now/CVE-2017-9332.md): The smarty\_self function in modules/module\_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in… (no CVSS)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/archive/2017-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.