# CVEs published 2016-04-18

55 CVEs were published on April 18, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-7378](https://cve.now/CVE-2015-7378.md): Panda Security URL Filtering before 4.3.1.9 uses a weak ACL for the "Panda Security URL Filtering" directory and installed files, which allo (no CVSS)
- [CVE-2016-3941](https://cve.now/CVE-2016-3941.md): Buffer overflow in the AStreamPeekStream function in input/stream.c in VideoLAN VLC media player before 2.2.0 allows remote attackers to cau (no CVSS)
- [CVE-2016-3943](https://cve.now/CVE-2016-3943.md): Panda Endpoint Administration Agent before 7.50.00, as used in Panda Security for Business products for Windows, uses a weak ACL for the Pan (no CVSS)
- [CVE-2016-3971](https://cve.now/CVE-2016-3971.md): Cross-site scripting (XSS) vulnerability in lucene\_search.jsp in dotCMS before 3.5.1 allows remote attackers to inject arbitrary web script (no CVSS)
- [CVE-2016-3972](https://cve.now/CVE-2016-3972.md): Directory traversal vulnerability in the dotTailLogServlet in dotCMS before 3.5.1 allows remote authenticated administrators to read arbitra (no CVSS)
- [CVE-2015-7552](https://cve.now/CVE-2015-7552.md): Heap-based buffer overflow in the gdk\_pixbuf\_flip function in gdk-pixbuf-scale.c in gdk-pixbuf 2.30.x allows remote attackers to cause a den (no CVSS)
- [CVE-2015-8106](https://cve.now/CVE-2015-8106.md): Format string vulnerability in the CmdKeywords function in funct1.c in latex2rtf before 2.3.10 allows remote attackers to execute arbitrary (no CVSS)
- [CVE-2016-3071](https://cve.now/CVE-2016-3071.md): Libreswan 3.16 might allow remote attackers to cause a denial of service (daemon restart) via an IKEv2 aes\_xcbc transform. (no CVSS)
- [CVE-2016-3950](https://cve.now/CVE-2016-3950.md): Huawei AR3200 routers with software before V200R006C10SPC300 allow remote authenticated users to cause a denial of service (restart) via cra (no CVSS)
- [CVE-2016-4036](https://cve.now/CVE-2016-4036.md): The quagga package before 0.99.23-2.6.1 in openSUSE and SUSE Linux Enterprise Server 11 SP 1 uses weak permissions for /etc/quagga, which al (no CVSS)
- [CVE-2016-1651](https://cve.now/CVE-2016-1651.md): fxcodec/codec/fx\_codec\_jpx\_opj.cpp in PDFium, as used in Google Chrome before 50.0.2661.75, does not properly implement the sycc420\_to\_rgb a (no CVSS)
- [CVE-2016-1652](https://cve.now/CVE-2016-1652.md): Cross-site scripting (XSS) vulnerability in the ModuleSystem::RequireForJsInner function in extensions/renderer/module\_system.cc in the Exte (no CVSS)
- [CVE-2016-1653](https://cve.now/CVE-2016-1653.md): The LoadBuffer implementation in Google V8, as used in Google Chrome before 50.0.2661.75, mishandles data types, which allows remote attacke (no CVSS)
- [CVE-2016-1654](https://cve.now/CVE-2016-1654.md): The media subsystem in Google Chrome before 50.0.2661.75 does not initialize an unspecified data structure, which allows remote attackers to (no CVSS)
- [CVE-2016-1655](https://cve.now/CVE-2016-1655.md): Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote att (no CVSS)
- [CVE-2016-1656](https://cve.now/CVE-2016-1656.md): The download implementation in Google Chrome before 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions (no CVSS)
- [CVE-2016-1657](https://cve.now/CVE-2016-1657.md): The WebContentsImpl::FocusLocationBarByDefault function in content/browser/web\_contents/web\_contents\_impl.cc in Google Chrome before 50.0.26 (no CVSS)
- [CVE-2016-1658](https://cve.now/CVE-2016-1658.md): The Extensions subsystem in Google Chrome before 50.0.2661.75 incorrectly relies on GetOrigin method calls for origin comparisons, which all (no CVSS)
- [CVE-2016-1659](https://cve.now/CVE-2016-1659.md): Multiple unspecified vulnerabilities in Google Chrome before 50.0.2661.75 allow attackers to cause a denial of service or possibly have othe (no CVSS)
- [CVE-2016-0834](https://cve.now/CVE-2016-0834.md): An unspecified media codec in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a deni (no CVSS)
- [CVE-2016-0835](https://cve.now/CVE-2016-0835.md): decoder/impeg2d\_dec\_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denia (no CVSS)
- [CVE-2016-0836](https://cve.now/CVE-2016-0836.md): Stack-based buffer overflow in decoder/impeg2d\_vld.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-0837](https://cve.now/CVE-2016-0837.md): MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016 (no CVSS)
- [CVE-2016-0838](https://cve.now/CVE-2016-0838.md): Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a n (no CVSS)
- [CVE-2016-0839](https://cve.now/CVE-2016-0839.md): post\_proc/volume\_listener.c in mediaserver in Android 6.x before 2016-04-01 mishandles deleted effect context, which allows remote attackers (no CVSS)
- [CVE-2016-0840](https://cve.now/CVE-2016-0840.md): Multiple stack-based buffer underflows in decoder/ih264d\_parse\_cavlc.c in mediaserver in Android 6.x before 2016-04-01 allow remote attacker (no CVSS)
- [CVE-2016-0841](https://cve.now/CVE-2016-0841.md): media/libmedia/mediametadataretriever.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before (no CVSS)
- [CVE-2016-0842](https://cve.now/CVE-2016-0842.md): The H.264 decoder in libstagefright in Android 6.x before 2016-04-01 mishandles Memory Management Control Operation (MMCO) data, which allow (no CVSS)
- [CVE-2016-0843](https://cve.now/CVE-2016-0843.md): The Qualcomm ARM processor performance-event manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 201 (no CVSS)
- [CVE-2016-0844](https://cve.now/CVE-2016-0844.md): The Qualcomm RF driver in Android 6.x before 2016-04-01 does not properly restrict access to socket ioctl calls, which allows attackers to g (no CVSS)
- [CVE-2016-0846](https://cve.now/CVE-2016-0846.md): libs/binder/IMemory.cpp in the IMemory Native Interface in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before (no CVSS)
- [CVE-2016-0847](https://cve.now/CVE-2016-0847.md): The Telecom Component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows attackers to spoof the originating (no CVSS)
- [CVE-2016-0848](https://cve.now/CVE-2016-0848.md): Race condition in Download Manager in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 allows att (no CVSS)
- [CVE-2016-0849](https://cve.now/CVE-2016-0849.md): Multiple integer overflows in minzip/SysUtil.c in the Recovery Procedure in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2 (no CVSS)
- [CVE-2016-0850](https://cve.now/CVE-2016-0850.md): The PORCHE\_PAIRING\_CONFLICT feature in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04 (no CVSS)
- [CVE-2016-1503](https://cve.now/CVE-2016-1503.md): dhcpcd before 6.10.0, as used in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 and other produ (no CVSS)
- [CVE-2016-2409](https://cve.now/CVE-2016-2409.md): A Texas Instruments (TI) haptic kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application (no CVSS)
- [CVE-2016-2410](https://cve.now/CVE-2016-2410.md): A Qualcomm video kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application that leverages (no CVSS)
- [CVE-2016-2411](https://cve.now/CVE-2016-2411.md): A Qualcomm Power Management kernel driver in Android 6.x before 2016-04-01 allows attackers to gain privileges via a crafted application tha (no CVSS)
- [CVE-2016-2412](https://cve.now/CVE-2016-2412.md): include/core/SkPostConfig.h in Skia, as used in System\_server in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x b (no CVSS)
- [CVE-2016-2413](https://cve.now/CVE-2016-2413.md): media/libmedia/IOMX.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not initialize a ha (no CVSS)
- [CVE-2016-2414](https://cve.now/CVE-2016-2414.md): The Minikin library in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not properly consider negative size va (no CVSS)
- [CVE-2016-2415](https://cve.now/CVE-2016-2415.md): exchange/eas/EasAutoDiscover.java in the Autodiscover implementation in Exchange ActiveSync in Android 5.0.x before 5.0.2, 5.1.x before 5.1. (no CVSS)
- [CVE-2016-2416](https://cve.now/CVE-2016-2416.md): libs/gui/BufferQueueConsumer.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04- (no CVSS)
- [CVE-2016-2417](https://cve.now/CVE-2016-2417.md): media/libmedia/IOMX.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does n (no CVSS)
- [CVE-2016-2418](https://cve.now/CVE-2016-2418.md): media/libmedia/IOMX.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize certain metadata buffer pointers, which allows a (no CVSS)
- [CVE-2016-2419](https://cve.now/CVE-2016-2419.md): media/libmedia/IDrm.cpp in mediaserver in Android 6.x before 2016-04-01 does not initialize a certain key-request data structure, which allo (no CVSS)
- [CVE-2016-2420](https://cve.now/CVE-2016-2420.md): rootdir/init.rc in Android 4.x before 4.4.4 does not ensure that the /data/tombstones directory exists for the Debuggerd component, which al (no CVSS)
- [CVE-2016-2421](https://cve.now/CVE-2016-2421.md): Setup Wizard in Android 5.1.x before 5.1.1 and 6.x before 2016-04-01 allows physically proximate attackers to bypass the Factory Reset Prote (no CVSS)
- [CVE-2016-2422](https://cve.now/CVE-2016-2422.md): Wi-Fi in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not prevent use of a Wi-Fi CA cert (no CVSS)
- [CVE-2016-2423](https://cve.now/CVE-2016-2423.md): server/telecom/CallsManager.java in Telephony in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 (no CVSS)
- [CVE-2016-2424](https://cve.now/CVE-2016-2424.md): server/content/SyncStorageEngine.java in SyncStorageEngine in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x befo (no CVSS)
- [CVE-2016-2425](https://cve.now/CVE-2016-2425.md): mail/compose/ComposeActivity.java in AOSP Mail in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-0 (no CVSS)
- [CVE-2016-2426](https://cve.now/CVE-2016-2426.md): server/content/ContentService.java in the Framework component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x b (no CVSS)
- [CVE-2016-2427](https://cve.now/CVE-2016-2427.md): The AES-GCM specification in RFC 5084, as used in Android 5.x and 6.x, recommends 12 octets for the aes-ICVlen parameter field, which might (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-04-18
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.