# CVEs published 2015-11-17 21 CVEs were published on November 17, 2015: 0 critical, 0 high. Days are UTC. - [CVE-2015-0272](https://cve.now/CVE-2015-0272.md): GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Route (no CVSS) - [CVE-2015-5217](https://cve.now/CVE-2015-5217.md): providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.1 does not properly check permissions to update t (no CVSS, ipsilon) - [CVE-2015-5276](https://cve.now/CVE-2015-5276.md): The std::random\_device class in libstdc++ in the GNU Compiler Collection (aka GCC) before 4.9.4 does not properly handle short reads from bl (no CVSS) - [CVE-2015-5301](https://cve.now/CVE-2015-5301.md): providers/saml2/admin.py in the Identity Provider (IdP) server in Ipsilon 0.1.0 before 1.0.2 and 1.1.x before 1.1.1 does not properly check (no CVSS, ipsilon) - [CVE-2015-5311](https://cve.now/CVE-2015-5311.md): PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and serv (no CVSS) - [CVE-2015-5602](https://cve.now/CVE-2015-5602.md): sudoedit in Sudo before 1.8.15 allows local users to gain privileges via a symlink attack on a file whose full path is defined using multipl (no CVSS) - [CVE-2015-7805](https://cve.now/CVE-2015-7805.md): Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in (no CVSS) - [CVE-2015-7812](https://cve.now/CVE-2015-7812.md): The hypercall\_create\_continuation function in arch/arm/domain.c in Xen 4.4.x through 4.6.x allows local guest users to cause a denial of ser (no CVSS) - [CVE-2015-7995](https://cve.now/CVE-2015-7995.md): The xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not check if the parent node is an element, which allows attackers to c (no CVSS) - [CVE-2015-7996](https://cve.now/CVE-2015-7996.md): The Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before Build 58. (no CVSS) - [CVE-2015-7997](https://cve.now/CVE-2015-7997.md): Multiple cross-site scripting (XSS) vulnerabilities in the Nitro API in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler (no CVSS) - [CVE-2015-7998](https://cve.now/CVE-2015-7998.md): The administration UI in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway before 10.1 Build 133.9, 10.5 before B (no CVSS) - [CVE-2015-8220](https://cve.now/CVE-2015-8220.md): Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote at (no CVSS) - [CVE-2015-8221](https://cve.now/CVE-2015-8221.md): Integer overflow in Google Picasa before 3.9.140 Build 259 allows remote attackers to execute arbitrary code via the CAMF section in a FOVb (no CVSS) - [CVE-2015-8222](https://cve.now/CVE-2015-8222.md): The lxd-unix.socket systemd unit file in the Ubuntu lxd package before 0.20-0ubuntu4.1 uses world-readable permissions for /var/lib/lxd/unix (no CVSS) - [CVE-2015-8232](https://cve.now/CVE-2015-8232.md): The UC Profile module 6.x-1.x before 6.x-1.3 for Drupal does not properly check access to profiles in certain circumstances, which might all (no CVSS) - [CVE-2015-8233](https://cve.now/CVE-2015-8233.md): Cross-site scripting (XSS) vulnerability in the MAYO theme 7.x-1.x before 7.x-1.4 and 7.x-2.x before 7.x-2.6 for Drupal allows remote admini (no CVSS) - [CVE-2015-8216](https://cve.now/CVE-2015-8216.md): The ljpeg\_decode\_yuv\_scan function in libavcodec/mjpegdec.c in FFmpeg before 2.8.2 omits certain width and height checks, which allows remot (no CVSS) - [CVE-2015-8217](https://cve.now/CVE-2015-8217.md): The ff\_hevc\_parse\_sps function in libavcodec/hevc\_ps.c in FFmpeg before 2.8.2 does not validate the Chroma Format Indicator, which allows re (no CVSS) - [CVE-2015-8218](https://cve.now/CVE-2015-8218.md): The decode\_uncompressed function in libavcodec/faxcompr.c in FFmpeg before 2.8.2 does not validate uncompressed runs, which allows remote at (no CVSS) - [CVE-2015-8219](https://cve.now/CVE-2015-8219.md): The init\_tile function in libavcodec/jpeg2000dec.c in FFmpeg before 2.8.2 does not enforce minimum-value and maximum-value constraints on ti (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-11-17 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.