# CVEs published 2016-03-29

8 CVEs were published on March 29, 2016: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-1760](https://cve.now/CVE-2016-1760.md): The XPC Services API in LaunchServices in Apple iOS before 9.3 allows attackers to bypass intended event-handler restrictions and modify an (no CVSS)
- [CVE-2016-2288](https://cve.now/CVE-2016-2288.md): Cogent DataHub before 7.3.10 allows local users to gain privileges by leveraging the user or guest role to modify a file. (no CVSS)
- [CVE-2016-1646](https://cve.now/CVE-2016-1646.md): The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly cons (CVSS 8.8, KEV)
- [CVE-2016-1647](https://cve.now/CVE-2016-1647.md): Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in content/browser/renderer\_host/render\_widget\_host\_impl.cc in th (no CVSS)
- [CVE-2016-1648](https://cve.now/CVE-2016-1648.md): Use-after-free vulnerability in the GetLoadTimes function in renderer/loadtimes\_extension\_bindings.cc in the Extensions implementation in Go (no CVSS)
- [CVE-2016-1649](https://cve.now/CVE-2016-1649.md): The Program::getUniformInternal function in Program.cpp in libANGLE, as used in Google Chrome before 49.0.2623.108, does not properly handle (no CVSS)
- [CVE-2016-1650](https://cve.now/CVE-2016-1650.md): The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in browser/extensions/api/page\_capture/page\_capture\_api.cc in Google Chrome befor (no CVSS)
- [CVE-2016-3679](https://cve.now/CVE-2016-3679.md): Multiple unspecified vulnerabilities in Google V8 before 4.9.385.33, as used in Google Chrome before 49.0.2623.108, allow attackers to cause (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-03-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.