# CVEs published 2016-01-20

13 CVEs were published on January 20, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-5295](https://cve.now/CVE-2015-5295.md): The template-validate command in OpenStack Orchestration API (Heat) before 2015.1.3 (kilo) and 5.0.x before 5.0.1 (liberty) allows remote au (no CVSS)
- [CVE-2015-5516](https://cve.now/CVE-2015-5516.md): Memory leak in the last hop kernel module in F5 BIG-IP LTM, GTM, and Link Controller 10.1.x, 10.2.x before 10.2.4 HF13, 11.x before 11.2.1 H (no CVSS)
- [CVE-2016-1867](https://cve.now/CVE-2016-1867.md): The jpc\_pi\_nextcprl function in JasPer 1.900.1 allows remote attackers to cause a denial of service (out-of-bounds read and application cras (no CVSS)
- [CVE-2016-1899](https://cve.now/CVE-2016-1899.md): CRLF injection vulnerability in the ui-blob handler in CGit before 0.12 allows remote attackers to inject arbitrary HTTP headers and conduct (no CVSS)
- [CVE-2016-1900](https://cve.now/CVE-2016-1900.md): CRLF injection vulnerability in the cgit\_print\_http\_headers function in ui-shared.c in CGit before 0.12 allows remote attackers with permiss (no CVSS)
- [CVE-2016-1901](https://cve.now/CVE-2016-1901.md): Integer overflow in the authenticate\_post function in CGit before 0.12 allows remote attackers to have unspecified impact via a large value (no CVSS)
- [CVE-2016-1928](https://cve.now/CVE-2016-1928.md): Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code vi (no CVSS)
- [CVE-2016-1929](https://cve.now/CVE-2016-1929.md): The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files and consequently cause a denial of service (disk consu (no CVSS)
- [CVE-2015-8704](https://cve.now/CVE-2015-8704.md): apl\_42.c in ISC BIND 9.x before 9.9.8-P3, 9.9.x, and 9.10.x before 9.10.3-P3 allows remote authenticated users to cause a denial of service (no CVSS)
- [CVE-2015-8705](https://cve.now/CVE-2015-8705.md): buffer.c in named in ISC BIND 9.10.x before 9.10.3-P3, when debug logging is enabled, allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2015-4951](https://cve.now/CVE-2015-4951.md): Client Acceptor Daemon (CAD) in the client in IBM Spectrum Protect (formerly Tivoli Storage Manager) 5.5 and 6.x before 6.3.2.5, 6.4 before (no CVSS)
- [CVE-2015-8777](https://cve.now/CVE-2015-8777.md): The process\_envvars function in elf/rtld.c in the GNU C Library (aka glibc or libc6) before 2.23 allows local users to bypass a pointer-guar (no CVSS)
- [CVE-2016-1296](https://cve.now/CVE-2016-1296.md): The proxy engine on Cisco Web Security Appliance (WSA) devices with software 8.5.3-055, 9.1.0-000, and 9.5.0-235 allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-01-20
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.