# CVEs published 2016-05-09 41 CVEs were published on May 9, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2015-5207](https://cve.now/CVE-2015-5207.md): Apache Cordova iOS before 4.0.0 might allow attackers to bypass a URL whitelist protection mechanism in an app and load arbitrary resources (no CVSS) - [CVE-2015-5208](https://cve.now/CVE-2015-5208.md): Apache Cordova iOS before 4.0.0 allows remote attackers to execute arbitrary plugins via a link. (no CVSS) - [CVE-2016-3105](https://cve.now/CVE-2016-3105.md): The convert extension in Mercurial before 3.8 might allow context-dependent attackers to execute arbitrary code via a crafted git repository (no CVSS, mercurial) - [CVE-2016-4350](https://cve.now/CVE-2016-4350.md): Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storag (no CVSS) - [CVE-2015-0569](https://cve.now/CVE-2015-0569.md): Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan\_hdd\_wext.c in the WLAN (aka Wi-Fi) driver for the (no CVSS) - [CVE-2015-0570](https://cve.now/CVE-2015-0570.md): Stack-based buffer overflow in the SET\_WPS\_IE IOCTL implementation in wlan\_hdd\_hostapd.c in the WLAN (aka Wi-Fi) driver for the Linux kernel (no CVSS) - [CVE-2015-0571](https://cve.now/CVE-2015-0571.md): The WLAN (aka Wi-Fi) driver for the Linux kernel 3.x and 4.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM dev (no CVSS) - [CVE-2016-2060](https://cve.now/CVE-2016-2060.md): server/TetherController.cpp in the tethering controller in netd, as distributed with Qualcomm Innovation Center (QuIC) Android contributions (no CVSS) - [CVE-2016-2428](https://cve.now/CVE-2016-2428.md): libAACdec/src/aacdec\_drc.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 d (no CVSS) - [CVE-2016-2429](https://cve.now/CVE-2016-2429.md): libFLAC/stream\_decoder.c in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does (no CVSS) - [CVE-2016-2430](https://cve.now/CVE-2016-2430.md): libbacktrace/Backtrace.cpp in debuggerd in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allow (no CVSS) - [CVE-2016-2431](https://cve.now/CVE-2016-2431.md): The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 5, Nexus 6, Nexus 7 (2013), and Android One devices allows attackers (no CVSS) - [CVE-2016-2432](https://cve.now/CVE-2016-2432.md): The Qualcomm TrustZone component in Android before 2016-05-01 on Nexus 6 and Android One devices allows attackers to gain privileges via a c (no CVSS) - [CVE-2016-2434](https://cve.now/CVE-2016-2434.md): The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS) - [CVE-2016-2435](https://cve.now/CVE-2016-2435.md): The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS) - [CVE-2016-2436](https://cve.now/CVE-2016-2436.md): The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS) - [CVE-2016-2437](https://cve.now/CVE-2016-2437.md): The NVIDIA video driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS) - [CVE-2016-2439](https://cve.now/CVE-2016-2439.md): Buffer overflow in btif/src/btif\_dm.c in Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016- (no CVSS) - [CVE-2016-2440](https://cve.now/CVE-2016-2440.md): libs/binder/IPCThreadState.cpp in Binder in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 mish (no CVSS) - [CVE-2016-2441](https://cve.now/CVE-2016-2441.md): The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted appl (no CVSS) - [CVE-2016-2442](https://cve.now/CVE-2016-2442.md): The Qualcomm buspm driver in Android before 2016-05-01 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted appl (no CVSS) - [CVE-2016-2443](https://cve.now/CVE-2016-2443.md): The Qualcomm MDP driver in Android before 2016-05-01 on Nexus 5 and Nexus 7 (2013) devices allows attackers to gain privileges via a crafted (no CVSS) - [CVE-2016-2444](https://cve.now/CVE-2016-2444.md): The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS) - [CVE-2016-2445](https://cve.now/CVE-2016-2445.md): The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS) - [CVE-2016-2446](https://cve.now/CVE-2016-2446.md): The NVIDIA media driver in Android before 2016-05-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS) - [CVE-2016-2448](https://cve.now/CVE-2016-2448.md): media/libmediaplayerservice/nuplayer/NuPlayerStreamListener.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before (no CVSS) - [CVE-2016-2449](https://cve.now/CVE-2016-2449.md): services/camera/libcameraservice/device3/Camera3Device.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1. (no CVSS) - [CVE-2016-2450](https://cve.now/CVE-2016-2450.md): codecs/on2/enc/SoftVPXEncoder.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and (no CVSS) - [CVE-2016-2451](https://cve.now/CVE-2016-2451.md): codecs/on2/dec/SoftVPX.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x bef (no CVSS) - [CVE-2016-2452](https://cve.now/CVE-2016-2452.md): codecs/amrnb/dec/SoftAMR.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x b (no CVSS) - [CVE-2016-2453](https://cve.now/CVE-2016-2453.md): The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, (no CVSS) - [CVE-2016-2454](https://cve.now/CVE-2016-2454.md): The Qualcomm hardware video codec in Android before 2016-05-01 on Nexus 5 devices allows remote attackers to cause a denial of service (rebo (no CVSS) - [CVE-2016-2456](https://cve.now/CVE-2016-2456.md): The MediaTek Wi-Fi driver in Android before 2016-05-01 on Android One devices allows attackers to gain privileges via a crafted application, (no CVSS) - [CVE-2016-2457](https://cve.now/CVE-2016-2457.md): server/pm/UserManagerService.java in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 allows attackers to (no CVSS) - [CVE-2016-2458](https://cve.now/CVE-2016-2458.md): The compose functionality in AOSP Mail in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not properly restri (no CVSS) - [CVE-2016-2459](https://cve.now/CVE-2016-2459.md): mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data (no CVSS) - [CVE-2016-2460](https://cve.now/CVE-2016-2460.md): mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-05-01 does not initialize certain data (no CVSS) - [CVE-2016-2461](https://cve.now/CVE-2016-2461.md): OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles resets of the Additional Authenticated Data (AAD) array, which a (no CVSS) - [CVE-2016-2462](https://cve.now/CVE-2016-2462.md): OpenSSLCipher.java in Conscrypt in Android 6.x before 2016-05-01 mishandles updates of the Additional Authenticated Data (AAD) array, which (no CVSS) - [CVE-2016-4476](https://cve.now/CVE-2016-4476.md): hostapd 0.6.7 through 2.5 and wpa\_supplicant 0.6.7 through 2.5 do not reject \\n and \\r characters in passphrase parameters, which allows rem (no CVSS) - [CVE-2016-4477](https://cve.now/CVE-2016-4477.md): wpa\_supplicant 0.4.0 through 2.5 does not reject \\n and \\r characters in passphrase parameters, which allows local users to trigger arbitrar (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-05-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.