# CVEs published 2015-08-24

45 CVEs were published on August 24, 2015: 0 critical, 1 high. Days are UTC.

- [CVE-2015-6241](https://cve.now/CVE-2015-6241.md): The proto\_tree\_add\_bytes\_item function in epan/proto.c in the protocol-tree implementation in Wireshark 1.12.x before 1.12.7 does not proper (no CVSS)
- [CVE-2015-6242](https://cve.now/CVE-2015-6242.md): The wmem\_block\_split\_free\_chunk function in epan/wmem/wmem\_allocator\_block.c in the wmem block allocator in the memory manager in Wireshark (no CVSS)
- [CVE-2015-6243](https://cve.now/CVE-2015-6243.md): The dissector-table implementation in epan/packet.c in Wireshark 1.12.x before 1.12.7 mishandles table searches for empty strings, which all (no CVSS)
- [CVE-2015-6244](https://cve.now/CVE-2015-6244.md): The dissect\_zbee\_secure function in epan/dissectors/packet-zbee-security.c in the ZigBee dissector in Wireshark 1.12.x before 1.12.7 imprope (no CVSS)
- [CVE-2015-6245](https://cve.now/CVE-2015-6245.md): epan/dissectors/packet-gsm\_rlcmac.c in the GSM RLC/MAC dissector in Wireshark 1.12.x before 1.12.7 uses incorrect integer data types, which (no CVSS)
- [CVE-2015-6246](https://cve.now/CVE-2015-6246.md): The dissect\_wa\_payload function in epan/dissectors/packet-waveagent.c in the WaveAgent dissector in Wireshark 1.12.x before 1.12.7 mishandle (no CVSS)
- [CVE-2015-6247](https://cve.now/CVE-2015-6247.md): The dissect\_openflow\_tablemod\_v5 function in epan/dissectors/packet-openflow\_v5.c in the OpenFlow dissector in Wireshark 1.12.x before 1.12. (no CVSS)
- [CVE-2015-6248](https://cve.now/CVE-2015-6248.md): The ptvcursor\_add function in the ptvcursor implementation in epan/proto.c in Wireshark 1.12.x before 1.12.7 does not check whether the expe (no CVSS)
- [CVE-2015-6249](https://cve.now/CVE-2015-6249.md): The dissect\_wccp2r1\_address\_table\_info function in epan/dissectors/packet-wccp.c in the WCCP dissector in Wireshark 1.12.x before 1.12.7 doe (no CVSS)
- [CVE-2015-5416](https://cve.now/CVE-2015-5416.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5417](https://cve.now/CVE-2015-5417.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5418](https://cve.now/CVE-2015-5418.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5419](https://cve.now/CVE-2015-5419.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5420](https://cve.now/CVE-2015-5420.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5421](https://cve.now/CVE-2015-5421.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5422](https://cve.now/CVE-2015-5422.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5423](https://cve.now/CVE-2015-5423.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2015-5424](https://cve.now/CVE-2015-5424.md): Unspecified vulnerability in HP KeyView before 10.23.0.1 and 10.24.x before 10.24.0.1 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2014-8628](https://cve.now/CVE-2014-8628.md): Memory leak in PolarSSL before 1.2.12 and 1.3.x before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a (no CVSS)
- [CVE-2014-8987](https://cve.now/CVE-2014-8987.md): Cross-site scripting (XSS) vulnerability in the "set configuration" box in the Configuration Report page (adm\_config\_report.php) in MantisBT (no CVSS)
- [CVE-2014-9744](https://cve.now/CVE-2014-9744.md): Memory leak in PolarSSL before 1.3.9 allows remote attackers to cause a denial of service (memory consumption) via a large number of ClientH (no CVSS)
- [CVE-2014-3612](https://cve.now/CVE-2014-3612.md): The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows r (no CVSS, org.apache.activemq:activemq-broker · org.apache.activemq:a…)
- [CVE-2014-6272](https://cve.now/CVE-2014-6272.md): Multiple integer overflows in the evbuffer API in Libevent 1.4.x before 1.4.15, 2.0.x before 2.0.22, and 2.1.x before 2.1.5-beta allow conte (no CVSS)
- [CVE-2015-0298](https://cve.now/CVE-2015-0298.md): Cross-site scripting (XSS) vulnerability in the manager web interface in mod\_cluster before 1.3.2.Alpha1 allows remote attackers to inject a (no CVSS)
- [CVE-2015-3238](https://cve.now/CVE-2015-3238.md): The \_unix\_run\_helper\_binary function in the pam\_unix module in Linux-PAM (aka pam) before 1.2.1, when unable to directly access passwords, a (no CVSS)
- [CVE-2015-5058](https://cve.now/CVE-2015-5058.md): Memory leak in the virtual server component in F5 Big-IP LTM, AAM, AFM, Analytics, APM, ASM, GTM, Link Controller, and PEM 11.5.x before 11. (no CVSS)
- [CVE-2015-5222](https://cve.now/CVE-2015-5222.md): Red Hat OpenShift Enterprise 3.0.0.0 does not properly check permissions, which allows remote authenticated users with build permissions to (no CVSS)
- [CVE-2015-5963](https://cve.now/CVE-2015-5963.md): contrib.sessions.middleware.SessionMiddleware in Django 1.8.x before 1.8.4, 1.7.x before 1.7.10, 1.4.x before 1.4.22, and possibly other ver (no CVSS, django)
- [CVE-2015-5964](https://cve.now/CVE-2015-5964.md): The (1) contrib.sessions.backends.base.SessionBase.flush and (2) cache\_db.SessionStore.flush functions in Django 1.7.x before 1.7.10, 1.4.x (no CVSS, django)
- [CVE-2015-6251](https://cve.now/CVE-2015-6251.md): Double free vulnerability in GnuTLS before 3.3.17 and 3.4.x before 3.4.4 allows remote attackers to cause a denial of service via a long Dis (no CVSS)
- [CVE-2015-6496](https://cve.now/CVE-2015-6496.md): conntrackd in conntrack-tools 1.4.2 and earlier does not ensure that the optional kernel modules are loaded before using them, which allows (no CVSS)
- [CVE-2015-6524](https://cve.now/CVE-2015-6524.md): The LDAPLoginModule implementation in the Java Authentication and Authorization Service (JAAS) in Apache ActiveMQ 5.x before 5.10.1 allows w (no CVSS, org.apache.activemq:activemq-broker · org.apache.activemq:a…)
- [CVE-2015-6525](https://cve.now/CVE-2015-6525.md): Multiple integer overflows in the evbuffer API in Libevent 2.0.x before 2.0.22 and 2.1.x before 2.1.5-beta allow context-dependent attackers (no CVSS)
- [CVE-2015-6658](https://cve.now/CVE-2015-6658.md): Cross-site scripting (XSS) vulnerability in the Autocomplete system in Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to (no CVSS)
- [CVE-2015-6659](https://cve.now/CVE-2015-6659.md): SQL injection vulnerability in the SQL comment filtering system in the Database API in Drupal 7.x before 7.39 allows remote attackers to exe (no CVSS)
- [CVE-2015-6660](https://cve.now/CVE-2015-6660.md): The Form API in Drupal 6.x before 6.37 and 7.x before 7.39 does not properly validate the form token, which allows remote attackers to condu (no CVSS)
- [CVE-2015-6661](https://cve.now/CVE-2015-6661.md): Drupal 6.x before 6.37 and 7.x before 7.39 allows remote attackers to obtain sensitive node titles by reading the menu. (no CVSS)
- [CVE-2015-6662](https://cve.now/CVE-2015-6662.md): XML external entity (XXE) vulnerability in SAP NetWeaver Portal 7.4 allows remote attackers to read arbitrary files and possibly have other (no CVSS)
- [CVE-2015-6663](https://cve.now/CVE-2015-6663.md): Cross-site scripting (XSS) vulnerability in the Client form in the Device Inspector page in SAP Afaria 7 allows remote attackers to inject a (no CVSS)
- [CVE-2015-6664](https://cve.now/CVE-2015-6664.md): XML external entity (XXE) vulnerability in the application import functionality in SAP Mobile Platform 2.3 allows remote attackers to read a (no CVSS)
- [CVE-2015-6665](https://cve.now/CVE-2015-6665.md): Cross-site scripting (XSS) vulnerability in the Ajax handler in Drupal 7.x before 7.39 and the Ctools module 6.x-1.x before 6.x-1.14 for Dru (no CVSS)
- [CVE-2015-5566](https://cve.now/CVE-2015-5566.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.232 on Windows and OS X and before 11.2.202.508 on Linux, Adobe AIR before (no CVSS)
- [CVE-2015-6563](https://cve.now/CVE-2015-6563.md): The monitor component in sshd in OpenSSH before 7.0 on non-OpenBSD platforms accepts extraneous username data in MONITOR\_REQ\_PAM\_INIT\_CTX re (CVSS 6.4)
- [CVE-2015-6564](https://cve.now/CVE-2015-6564.md): Use-after-free vulnerability in the mm\_answer\_pam\_free\_ctx function in monitor.c in sshd in OpenSSH before 7.0 on non-OpenBSD platforms migh (CVSS 7.0)
- [CVE-2015-6565](https://cve.now/CVE-2015-6565.md): sshd in OpenSSH 6.8 and 6.9 uses world-writable permissions for TTY devices, which allows local users to cause a denial of service (terminal (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-08-24
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.