# CVEs published 2016-05-05 25 CVEs were published on May 5, 2016: 0 critical, 1 high. 3 are now in CISA KEV. Days are UTC. - [CVE-2016-1368](https://cve.now/CVE-2016-1368.md): Cisco FirePOWER System Software 5.3.x through 5.3.0.6 and 5.4.x through 5.4.0.3 on FirePOWER 7000 and 8000 appliances, and on the Advanced M (no CVSS) - [CVE-2016-1369](https://cve.now/CVE-2016-1369.md): The Adaptive Security Appliance (ASA) 5585-X FirePOWER Security Services Processor (SSP) module for Cisco ASA with FirePOWER Services 5.3.1 (no CVSS) - [CVE-2016-1373](https://cve.now/CVE-2016-1373.md): The gadgets-integration API in Cisco Finesse 8.5(1) through 8.5(5), 8.6(1), 9.0(1), 9.0(2), 9.1(1), 9.1(1)SU1, 9.1(1)SU1.1, 9.1(1)ES1 throug (no CVSS) - [CVE-2016-1387](https://cve.now/CVE-2016-1387.md): The XML API in TelePresence Codec (TC) 7.2.0, 7.2.1, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, and 7.3.5 and Collaboration Endpoint (CE) 8.0.0, 8.0 (no CVSS) - [CVE-2016-1392](https://cve.now/CVE-2016-1392.md): Open redirect vulnerability in Cisco Prime Collaboration Assurance Software 10.5 through 11.0 allows remote attackers to redirect users to a (no CVSS) - [CVE-2016-2059](https://cve.now/CVE-2016-2059.md): The msm\_ipc\_router\_bind\_control\_port function in net/ipc\_router/ipc\_router\_core.c in the IPC router kernel module for the Linux kernel 3.x, (no CVSS) - [CVE-2016-2062](https://cve.now/CVE-2016-2062.md): The adreno\_perfcounter\_query\_group function in drivers/gpu/msm/adreno\_perfcounter.c in the Adreno GPU driver for the Linux kernel 3.x, as us (no CVSS) - [CVE-2016-2167](https://cve.now/CVE-2016-2167.md): The canonicalize\_username function in svnserve/cyrus\_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authe (no CVSS) - [CVE-2016-2168](https://cve.now/CVE-2016-2168.md): The req\_check\_access function in the mod\_authz\_svn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allo (no CVSS) - [CVE-2016-3714](https://cve.now/CVE-2016-3714.md): The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x befor (CVSS 8.4, KEV) - [CVE-2016-3715](https://cve.now/CVE-2016-3715.md): The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted im (CVSS 5.5, KEV) - [CVE-2016-3716](https://cve.now/CVE-2016-3716.md): The MSL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to move arbitrary files via a crafted image. (no CVSS) - [CVE-2016-3717](https://cve.now/CVE-2016-3717.md): The LABEL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to read arbitrary files via a crafted image. (no CVSS) - [CVE-2016-3718](https://cve.now/CVE-2016-3718.md): The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request (CVSS 5.5, KEV) - [CVE-2016-4008](https://cve.now/CVE-2016-4008.md): The \_asn1\_extract\_der\_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1\_DECODE\_FLAG\_STRICT\_DER flag, a (no CVSS) - [CVE-2016-4351](https://cve.now/CVE-2016-4351.md): SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows (no CVSS) - [CVE-2016-4534](https://cve.now/CVE-2016-4534.md): The McAfee VirusScan Console (mcconsol.exe) in McAfee VirusScan Enterprise 8.8.0 before Hotfix 1123565 (8.8.0.1546) on Windows allows local (no CVSS) - [CVE-2016-4535](https://cve.now/CVE-2016-4535.md): Integer signedness error in the AV engine before DAT 8145, as used in McAfee LiveSafe 14.0, allows remote attackers to cause a denial of ser (no CVSS) - [CVE-2000-1254](https://cve.now/CVE-2000-1254.md): crypto/rsa/rsa\_gen.c in OpenSSL before 0.9.6 mishandles C bitwise-shift operations that exceed the size of an expression, which makes it eas (no CVSS) - [CVE-2016-2105](https://cve.now/CVE-2016-2105.md): Integer overflow in the EVP\_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote atta (no CVSS) - [CVE-2016-2106](https://cve.now/CVE-2016-2106.md): Integer overflow in the EVP\_EncryptUpdate function in crypto/evp/evp\_enc.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote at (no CVSS) - [CVE-2016-2107](https://cve.now/CVE-2016-2107.md): The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding chec (no CVSS) - [CVE-2016-2108](https://cve.now/CVE-2016-2108.md): The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denia (no CVSS) - [CVE-2016-2109](https://cve.now/CVE-2016-2109.md): The asn1\_d2i\_read\_bio function in crypto/asn1/a\_d2i\_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h al (no CVSS) - [CVE-2016-2176](https://cve.now/CVE-2016-2176.md): The X509\_NAME\_oneline function in crypto/x509/x509\_obj.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to obtain (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-05-05 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.