# CVEs published 2015-12-07

17 CVEs were published on December 7, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2015-1342](https://cve.now/CVE-2015-1342.md): LXCFS before 0.12 does not properly enforce directory escapes, which might allow local users to gain privileges by (1) querying or (2) updat (no CVSS)
- [CVE-2015-1344](https://cve.now/CVE-2015-1344.md): The do\_write\_pids function in lxcfs.c in LXCFS before 0.12 does not properly check permissions, which allows local users to gain privileges (no CVSS)
- [CVE-2015-3276](https://cve.now/CVE-2015-3276.md): The nss\_parse\_ciphers function in libraries/libldap/tls\_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher stri (no CVSS)
- [CVE-2015-3628](https://cve.now/CVE-2015-3628.md): The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, (no CVSS)
- [CVE-2015-4334](https://cve.now/CVE-2015-4334.md): The default configuration of SGOS in Blue Coat ProxySG before 6.2.16.5, 6.5 before 6.5.7.1, and 6.6 before 6.6.2.1 forwards authentication c (no CVSS)
- [CVE-2015-5006](https://cve.now/CVE-2015-5006.md): IBM Java Security Components in IBM SDK, Java Technology Edition 8 before SR2, 7 R1 before SR3 FP20, 7 before SR9 FP20, 6 R1 before SR8 FP15 (no CVSS)
- [CVE-2015-5309](https://cve.now/CVE-2015-5309.md): Integer overflow in the terminal emulator in PuTTY before 0.66 allows remote attackers to cause a denial of service (memory corruption) or p (no CVSS)
- [CVE-2015-7348](https://cve.now/CVE-2015-7348.md): Cross-site scripting (XSS) vulnerability in zTree 3.5.19.1 and possibly earlier allows remote attackers to inject arbitrary web script or HT (no CVSS)
- [CVE-2015-8084](https://cve.now/CVE-2015-8084.md): Huawei USG5500, USG2100, USG2200, and USG5100 unified security gateways with software before V300R001C10SPC600, when "DHCP Snooping" is enab (no CVSS)
- [CVE-2015-8124](https://cve.now/CVE-2015-8124.md): Session fixation vulnerability in the "Remember Me" login feature in Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7. (no CVSS, symfony/symfony · symfony/security-http +1)
- [CVE-2015-8125](https://cve.now/CVE-2015-8125.md): Symfony 2.3.x before 2.3.35, 2.6.x before 2.6.12, and 2.7.x before 2.7.7 might allow remote attackers to have unspecified impact via a timin (no CVSS, symfony/symfony · symfony/form +2)
- [CVE-2015-8131](https://cve.now/CVE-2015-8131.md): Cross-site request forgery (CSRF) vulnerability in Elasticsearch Kibana before 4.1.3 and 4.2.x before 4.2.1 allows remote attackers to hijac (no CVSS)
- [CVE-2015-8213](https://cve.now/CVE-2015-8213.md): The get\_format function in utils/formats.py in Django before 1.7.x before 1.7.11, 1.8.x before 1.8.7, and 1.9.x before 1.9rc2 might allow re (no CVSS, django)
- [CVE-2015-8482](https://cve.now/CVE-2015-8482.md): Blue Coat Unified Agent before 4.6.2 does not prevent modification of its configuration files when running in local enforcement mode, which (no CVSS)
- [CVE-2015-5273](https://cve.now/CVE-2015-5273.md): The abrt-action-install-debuginfo-to-abrt-cache help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users to write (no CVSS)
- [CVE-2015-5287](https://cve.now/CVE-2015-5287.md): The abrt-hook-ccpp help program in Automatic Bug Reporting Tool (ABRT) before 2.7.1 allows local users with certain permissions to gain priv (CVSS 7.8, KEV)
- [CVE-2015-5302](https://cve.now/CVE-2015-5302.md): libreport 2.0.7 before 2.6.3 only saves changes to the first file when editing a crash report, which allows remote attackers to obtain sensi (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-12-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.