# CVEs published 2015-12-09 58 CVEs were published on December 9, 2015: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2015-6040](https://cve.now/CVE-2015-6040.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Excel 2016 for Mac, Office Compatibility Pack SP3, and Excel Viewer allow remo (no CVSS) - [CVE-2015-6083](https://cve.now/CVE-2015-6083.md): Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-6106](https://cve.now/CVE-2015-6106.md): The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for B (no CVSS) - [CVE-2015-6107](https://cve.now/CVE-2015-6107.md): The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows (no CVSS) - [CVE-2015-6108](https://cve.now/CVE-2015-6108.md): The Windows font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8; Windows 8.1; Windows (no CVSS) - [CVE-2015-6114](https://cve.now/CVE-2015-6114.md): Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Mic (no CVSS) - [CVE-2015-6118](https://cve.now/CVE-2015-6118.md): Microsoft Office 2007 SP3 and Office 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft (no CVSS) - [CVE-2015-6122](https://cve.now/CVE-2015-6122.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel for Mac 2011, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to exec (no CVSS) - [CVE-2015-6124](https://cve.now/CVE-2015-6124.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow remote att (no CVSS) - [CVE-2015-6125](https://cve.now/CVE-2015-6125.md): Use-after-free vulnerability in the DNS server in Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allows remote att (no CVSS) - [CVE-2015-6126](https://cve.now/CVE-2015-6126.md): Race condition in the Pragmatic General Multicast (PGM) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and (no CVSS) - [CVE-2015-6127](https://cve.now/CVE-2015-6127.md): Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to read arbitrary fil (no CVSS) - [CVE-2015-6128](https://cve.now/CVE-2015-6128.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to ga (no CVSS) - [CVE-2015-6130](https://cve.now/CVE-2015-6130.md): Integer underflow in Uniscribe in Microsoft Windows 7 SP1 and Windows Server 2008 R2 SP1 allows remote attackers to execute arbitrary code v (no CVSS) - [CVE-2015-6131](https://cve.now/CVE-2015-6131.md): Windows Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, Windows 8, and Windows 8.1 allows remote attackers to execute arbitrary (no CVSS) - [CVE-2015-6132](https://cve.now/CVE-2015-6132.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Win (no CVSS) - [CVE-2015-6133](https://cve.now/CVE-2015-6133.md): Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library l (no CVSS) - [CVE-2015-6134](https://cve.now/CVE-2015-6134.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS) - [CVE-2015-6135](https://cve.now/CVE-2015-6135.md): The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al (no CVSS) - [CVE-2015-6136](https://cve.now/CVE-2015-6136.md): The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, al (no CVSS) - [CVE-2015-6138](https://cve.now/CVE-2015-6138.md): Microsoft Internet Explorer 8 through 11 mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site (no CVSS) - [CVE-2015-6139](https://cve.now/CVE-2015-6139.md): Microsoft Internet Explorer 11 and Microsoft Edge mishandle content types, which allows remote attackers to execute arbitrary web script in (no CVSS) - [CVE-2015-6140](https://cve.now/CVE-2015-6140.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2015-6141](https://cve.now/CVE-2015-6141.md): Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft (no CVSS) - [CVE-2015-6142](https://cve.now/CVE-2015-6142.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2015-6143](https://cve.now/CVE-2015-6143.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS) - [CVE-2015-6144](https://cve.now/CVE-2015-6144.md): Microsoft Internet Explorer 8 through 11 and Microsoft Edge mishandle HTML attributes in HTTP responses, which allows remote attackers to by (no CVSS) - [CVE-2015-6145](https://cve.now/CVE-2015-6145.md): Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS) - [CVE-2015-6146](https://cve.now/CVE-2015-6146.md): Microsoft Internet Explorer 7 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS) - [CVE-2015-6147](https://cve.now/CVE-2015-6147.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS) - [CVE-2015-6148](https://cve.now/CVE-2015-6148.md): Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2015-6149](https://cve.now/CVE-2015-6149.md): Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a (no CVSS) - [CVE-2015-6150](https://cve.now/CVE-2015-6150.md): Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-6151](https://cve.now/CVE-2015-6151.md): Microsoft Internet Explorer 8 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2015-6152](https://cve.now/CVE-2015-6152.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS) - [CVE-2015-6153](https://cve.now/CVE-2015-6153.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2015-6154](https://cve.now/CVE-2015-6154.md): Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (m (no CVSS) - [CVE-2015-6155](https://cve.now/CVE-2015-6155.md): Microsoft Internet Explorer 10 and 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memo (no CVSS) - [CVE-2015-6156](https://cve.now/CVE-2015-6156.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS) - [CVE-2015-6157](https://cve.now/CVE-2015-6157.md): Microsoft Internet Explorer 11 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Inte (no CVSS) - [CVE-2015-6158](https://cve.now/CVE-2015-6158.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2015-6159](https://cve.now/CVE-2015-6159.md): Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corr (no CVSS) - [CVE-2015-6160](https://cve.now/CVE-2015-6160.md): Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS) - [CVE-2015-6161](https://cve.now/CVE-2015-6161.md): Microsoft Internet Explorer 7 through 11 and Microsoft Edge allow remote attackers to bypass the ASLR protection mechanism via a crafted web (no CVSS) - [CVE-2015-6162](https://cve.now/CVE-2015-6162.md): Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf (no CVSS) - [CVE-2015-6164](https://cve.now/CVE-2015-6164.md): Microsoft Internet Explorer 9 through 11 improperly implements a cross-site scripting (XSS) protection mechanism, which allows remote attack (no CVSS) - [CVE-2015-6165](https://cve.now/CVE-2015-6165.md): Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Mic (no CVSS) - [CVE-2015-6166](https://cve.now/CVE-2015-6166.md): Microsoft Silverlight 5 before 5.1.41105.00 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds re (no CVSS) - [CVE-2015-6168](https://cve.now/CVE-2015-6168.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak (no CVSS) - [CVE-2015-6169](https://cve.now/CVE-2015-6169.md): Microsoft Edge misparses HTTP responses, which allows remote attackers to redirect users to arbitrary web sites via unspecified vectors, aka (no CVSS) - [CVE-2015-6170](https://cve.now/CVE-2015-6170.md): Microsoft Edge allows remote attackers to gain privileges via a crafted web site, aka "Microsoft Browser Elevation of Privilege Vulnerabilit (no CVSS) - [CVE-2015-6171](https://cve.now/CVE-2015-6171.md): The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Go (no CVSS) - [CVE-2015-6172](https://cve.now/CVE-2015-6172.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2016, Word 2013 RT SP1, and Office Compatibility Pack SP3 allow (no CVSS) - [CVE-2015-6173](https://cve.now/CVE-2015-6173.md): The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Go (no CVSS) - [CVE-2015-6174](https://cve.now/CVE-2015-6174.md): The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Go (no CVSS) - [CVE-2015-6175](https://cve.now/CVE-2015-6175.md): The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevatio (CVSS 7.8, KEV) - [CVE-2015-6176](https://cve.now/CVE-2015-6176.md): Microsoft Edge mishandles HTML attributes in HTTP responses, which allows remote attackers to bypass a cross-site scripting (XSS) protection (no CVSS) - [CVE-2015-6177](https://cve.now/CVE-2015-6177.md): Microsoft Excel 2007 SP3, Office Compatibility Pack SP3, and Excel Viewer allow remote attackers to execute arbitrary code via a crafted Off (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2015-12-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.