# CVEs published 2014-12-20

9 CVEs were published on December 20, 2014: 0 critical, 0 high. Days are UTC.

- [CVE-2014-8142](https://cve.now/CVE-2014-8142.md): Use-after-free vulnerability in the process\_nested\_data function in ext/standard/var\_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5. (no CVSS)
- [CVE-2014-9293](https://cve.now/CVE-2014-9293.md): The config\_auth function in ntpd in NTP before 4.2.7p11, when an auth key is not configured, improperly generates a key, which makes it easi (no CVSS)
- [CVE-2014-9294](https://cve.now/CVE-2014-9294.md): util/ntp-keygen.c in ntp-keygen in NTP before 4.2.7p230 uses a weak RNG seed, which makes it easier for remote attackers to defeat cryptogra (no CVSS)
- [CVE-2014-9295](https://cve.now/CVE-2014-9295.md): Multiple stack-based buffer overflows in ntpd in NTP before 4.2.8 allow remote attackers to execute arbitrary code via a crafted packet, rel (no CVSS)
- [CVE-2014-9296](https://cve.now/CVE-2014-9296.md): The receive function in ntp\_proto.c in ntpd in NTP before 4.2.8 continues to execute after detecting a certain authentication error, which m (no CVSS)
- [CVE-2014-3410](https://cve.now/CVE-2014-3410.md): The syslog-management subsystem in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to obtain an administrator passw (no CVSS)
- [CVE-2014-8007](https://cve.now/CVE-2014-8007.md): Cisco Prime Infrastructure allows remote authenticated users to read device-discovery passwords by examining the HTML source code of the Qui (no CVSS)
- [CVE-2014-8019](https://cve.now/CVE-2014-8019.md): Directory traversal vulnerability in Cisco Enterprise Content Delivery System (ECDS) allows remote attackers to read arbitrary files via a c (no CVSS)
- [CVE-2014-9193](https://cve.now/CVE-2014-9193.md): Innominate mGuard Improper Privilege Management (no CVSS, Innominate mGuard)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2014-12-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.