# CVEs published 2009-12-24

16 CVEs were published on December 24, 2009: 0 critical, 0 high. Days are UTC.

- [CVE-2009-4417](https://cve.now/CVE-2009-4417.md): The shutdown function in the Zend\_Log\_Writer\_Mail class in Zend Framework (ZF) allows context-dependent attackers to send arbitrary e-mail m (no CVSS)
- [CVE-2009-4418](https://cve.now/CVE-2009-4418.md): The unserialize function in PHP 5.3.0 and earlier allows context-dependent attackers to cause a denial of service (resource consumption) via (no CVSS)
- [CVE-2009-4419](https://cve.now/CVE-2009-4419.md): Intel Q35, GM45, PM45 Express, Q45, and Q43 Express chipsets in the SINIT Authenticated Code Module (ACM), which allows local users to bypas (no CVSS)
- [CVE-2009-4420](https://cve.now/CVE-2009-4420.md): Buffer overflow in the bd daemon in F5 Networks BIG-IP Application Security Manager (ASM) 9.4.4 through 9.4.7 and 10.0.0 through 10.0.1, and (no CVSS)
- [CVE-2009-4421](https://cve.now/CVE-2009-4421.md): Directory traversal vulnerability in languages\_cgi.php in Simple PHP Blog 0.5.1 and earlier allows remote authenticated users to include and (no CVSS)
- [CVE-2009-4422](https://cve.now/CVE-2009-4422.md): Multiple cross-site scripting (XSS) vulnerabilities in the GetURLArguments function in jpgraph.php in Aditus Consulting JpGraph 3.0.6 allow (no CVSS)
- [CVE-2009-4423](https://cve.now/CVE-2009-4423.md): SQL injection vulnerability in index.php in weenCompany 4.0.0 allows remote attackers to execute arbitrary SQL commands via the moduleid par (no CVSS)
- [CVE-2009-3305](https://cve.now/CVE-2009-3305.md): Polipo 1.0.4, and possibly other versions, allows remote attackers to cause a denial of service (crash) via a request with a Cache-Control h (no CVSS)
- [CVE-2009-4137](https://cve.now/CVE-2009-4137.md): The loadContentFromCookie function in core/Cookie.php in Piwik before 0.5 does not validate strings obtained from cookies before calling the (no CVSS)
- [CVE-2009-4410](https://cve.now/CVE-2009-4410.md): The fuse\_ioctl\_copy\_user function in the ioctl handler in fs/fuse/file.c in the Linux kernel 2.6.29-rc1 through 2.6.30.y uses the wrong vari (no CVSS)
- [CVE-2009-4411](https://cve.now/CVE-2009-4411.md): The (1) setfacl and (2) getfacl commands in XFS acl 2.2.47, when running in recursive (-R) mode, follow symbolic links even when the --physi (no CVSS)
- [CVE-2009-4412](https://cve.now/CVE-2009-4412.md): Unrestricted file upload vulnerability in Serendipity before 1.5 allows remote authenticated users to execute arbitrary code by uploading a (no CVSS)
- [CVE-2009-4413](https://cve.now/CVE-2009-4413.md): The httpClientDiscardBody function in client.c in Polipo 0.9.8, 0.9.12, 1.0.4, and possibly other versions, allows remote attackers to cause (no CVSS)
- [CVE-2009-4414](https://cve.now/CVE-2009-4414.md): SQL injection vulnerability in phpgwapi /inc/class.auth\_sql.inc.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014 (no CVSS)
- [CVE-2009-4415](https://cve.now/CVE-2009-4415.md): Multiple directory traversal vulnerabilities in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allow remote attacker (no CVSS)
- [CVE-2009-4416](https://cve.now/CVE-2009-4416.md): Cross-site scripting (XSS) vulnerability in login.php in phpGroupWare 0.9.16.12, and possibly other versions before 0.9.16.014, allows remot (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2009-12-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.