# CVEs published 2015-12-16

38 CVEs were published on December 16, 2015: 0 critical, 1 high. Days are UTC.

- [CVE-2015-5304](https://cve.now/CVE-2015-5304.md): Red Hat JBoss Enterprise Application Platform (EAP) before 6.4.5 does not properly authorize access to shut down the server, which allows re (no CVSS)
- [CVE-2015-8357](https://cve.now/CVE-2015-8357.md): Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary f (no CVSS)
- [CVE-2015-8358](https://cve.now/CVE-2015-8358.md): Directory traversal vulnerability in the bitrix.mpbuilder module before 1.0.12 for Bitrix allows remote administrators to include and execut (no CVSS)
- [CVE-2015-8476](https://cve.now/CVE-2015-8476.md): Multiple CRLF injection vulnerabilities in PHPMailer before 5.2.14 allow attackers to inject arbitrary SMTP commands via CRLF sequences in a (no CVSS, phpmailer/phpmailer)
- [CVE-2015-8562](https://cve.now/CVE-2015-8562.md): Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via t (no CVSS)
- [CVE-2015-8563](https://cve.now/CVE-2015-8563.md): Cross-site request forgery (CSRF) vulnerability in the com\_templates component in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows (no CVSS)
- [CVE-2015-8564](https://cve.now/CVE-2015-8564.md): Directory traversal vulnerability in Joomla! 3.4.x before 3.4.6 allows remote attackers to have unspecified impact via directory traversal s (no CVSS)
- [CVE-2015-8565](https://cve.now/CVE-2015-8565.md): Directory traversal vulnerability in Joomla! 3.2.0 through 3.3.x and 3.4.x before 3.4.6 allows remote attackers to have unspecified impact v (no CVSS)
- [CVE-2015-8566](https://cve.now/CVE-2015-8566.md): The Session package 1.x before 1.3.1 for Joomla! Framework allows remote attackers to execute arbitrary code via unspecified session values. (no CVSS, joomla/session)
- [CVE-2015-8580](https://cve.now/CVE-2015-8580.md): Multiple use-after-free vulnerabilities in the (1) Print method and (2) App object handling in Foxit Reader before 7.2.2 and Foxit PhantomPD (no CVSS)
- [CVE-2015-8577](https://cve.now/CVE-2015-8577.md): The Buffer Overflow Protection (BOP) feature in McAfee VirusScan Enterprise before 8.8 Patch 6 allocates memory with Read, Write, Execute (R (no CVSS)
- [CVE-2015-8578](https://cve.now/CVE-2015-8578.md): AVG Internet Security 2015 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecting user-mode p (no CVSS)
- [CVE-2015-8579](https://cve.now/CVE-2015-8579.md): Kaspersky Total Security 2015 15.0.2.361 allocates memory with Read, Write, Execute (RWX) permissions at predictable addresses when protecti (no CVSS)
- [CVE-2015-6425](https://cve.now/CVE-2015-6425.md): The WebApplications Identity Management subsystem in Cisco Unified Communications Manager 10.5(0.98000.88) allows remote attackers to cause (no CVSS)
- [CVE-2015-8000](https://cve.now/CVE-2015-8000.md): db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE asse (no CVSS)
- [CVE-2015-8461](https://cve.now/CVE-2015-8461.md): Race condition in resolver.c in named in ISC BIND 9.9.8 before 9.9.8-P2 and 9.10.3 before 9.10.3-P2 allows remote attackers to cause a denia (no CVSS)
- [CVE-2015-7201](https://cve.now/CVE-2015-7201.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote atta (no CVSS)
- [CVE-2015-7202](https://cve.now/CVE-2015-7202.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 43.0 allow remote attackers to cause a denial of servic (no CVSS)
- [CVE-2015-7203](https://cve.now/CVE-2015-7203.md): Buffer overflow in the DirectWriteFontInfo::LoadFontFamilyData function in gfx/thebes/gfxDWriteFontList.cpp in Mozilla Firefox before 43.0 m (no CVSS)
- [CVE-2015-7204](https://cve.now/CVE-2015-7204.md): Mozilla Firefox before 43.0 does not properly store the properties of unboxed objects, which allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2015-7205](https://cve.now/CVE-2015-7205.md): Integer underflow in the RTPReceiverVideo::ParseRtpPacket function in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 might all (no CVSS)
- [CVE-2015-7207](https://cve.now/CVE-2015-7207.md): Mozilla Firefox before 43.0 does not properly restrict the availability of IFRAME Resource Timing API times, which allows remote attackers t (no CVSS)
- [CVE-2015-7208](https://cve.now/CVE-2015-7208.md): Mozilla Firefox before 43.0 stores cookies containing vertical tab characters, which allows remote attackers to obtain sensitive information (no CVSS)
- [CVE-2015-7210](https://cve.now/CVE-2015-7210.md): Use-after-free vulnerability in Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allows remote attackers to execute arbitrary co (no CVSS)
- [CVE-2015-7211](https://cve.now/CVE-2015-7211.md): Mozilla Firefox before 43.0 mishandles the # (number sign) character in a data: URI, which allows remote attackers to spoof web sites via un (no CVSS)
- [CVE-2015-7212](https://cve.now/CVE-2015-7212.md): Integer overflow in the mozilla::layers::BufferTextureClient::AllocateForSurface function in Mozilla Firefox before 43.0 and Firefox ESR 38. (no CVSS)
- [CVE-2015-7213](https://cve.now/CVE-2015-7213.md): Integer overflow in the MPEG4Extractor::readMetaData function in MPEG4Extractor.cpp in libstagefright in Mozilla Firefox before 43.0 and Fir (no CVSS)
- [CVE-2015-7214](https://cve.now/CVE-2015-7214.md): Mozilla Firefox before 43.0 and Firefox ESR 38.x before 38.5 allow remote attackers to bypass the Same Origin Policy via data: and view-sour (no CVSS)
- [CVE-2015-7215](https://cve.now/CVE-2015-7215.md): The importScripts function in the Web Workers API implementation in Mozilla Firefox before 43.0 allows remote attackers to bypass the Same O (no CVSS)
- [CVE-2015-7216](https://cve.now/CVE-2015-7216.md): The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the JasPer decoder, which allows re (no CVSS)
- [CVE-2015-7217](https://cve.now/CVE-2015-7217.md): The gdk-pixbuf configuration in Mozilla Firefox before 43.0 on Linux GNOME platforms incorrectly enables the TGA decoder, which allows remot (no CVSS)
- [CVE-2015-7218](https://cve.now/CVE-2015-7218.md): The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion (no CVSS)
- [CVE-2015-7219](https://cve.now/CVE-2015-7219.md): The HTTP/2 implementation in Mozilla Firefox before 43.0 allows remote attackers to cause a denial of service (integer underflow, assertion (no CVSS)
- [CVE-2015-7220](https://cve.now/CVE-2015-7220.md): Buffer overflow in the XDRBuffer::grow function in js/src/vm/Xdr.cpp in Mozilla Firefox before 43.0 might allow remote attackers to cause a (no CVSS)
- [CVE-2015-7221](https://cve.now/CVE-2015-7221.md): Buffer overflow in the nsDeque::GrowCapacity function in xpcom/glue/nsDeque.cpp in Mozilla Firefox before 43.0 might allow remote attackers (no CVSS)
- [CVE-2015-7222](https://cve.now/CVE-2015-7222.md): Integer underflow in the Metadata::setData function in MetaData.cpp in libstagefright in Mozilla Firefox before 43.0 and Firefox ESR 38.x be (no CVSS)
- [CVE-2015-7223](https://cve.now/CVE-2015-7223.md): The WebExtension APIs in Mozilla Firefox before 43.0 allow remote attackers to gain privileges, and possibly obtain sensitive information or (no CVSS)
- [CVE-2015-8370](https://cve.now/CVE-2015-8370.md): Multiple integer underflows in Grub2 1.98 through 2.02 allow physically proximate attackers to bypass authentication, obtain sensitive infor (CVSS 7.4)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2015-12-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.