# CVEs published 2016-05-13 25 CVEs were published on May 13, 2016: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2011-5326](https://cve.now/CVE-2011-5326.md): imlib2 before 1.4.9 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) by drawing a 2x1 ellip (no CVSS) - [CVE-2014-9762](https://cve.now/CVE-2014-9762.md): imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a GIF image without a colormap. (no CVSS) - [CVE-2014-9763](https://cve.now/CVE-2014-9763.md): imlib2 before 1.4.7 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted PNM file (no CVSS) - [CVE-2014-9764](https://cve.now/CVE-2014-9764.md): imlib2 before 1.4.7 allows remote attackers to cause a denial of service (segmentation fault) via a crafted GIF file. (no CVSS) - [CVE-2014-9771](https://cve.now/CVE-2014-9771.md): Integer overflow in imlib2 before 1.4.7 allows remote attackers to cause a denial of service (memory consumption or application crash) via a (no CVSS) - [CVE-2015-8099](https://cve.now/CVE-2015-8099.md): F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.x, 11.4.x before 11.4.1 HF10, 11.5.x before 11.5.4, 11.6.x before 11. (no CVSS) - [CVE-2015-8312](https://cve.now/CVE-2015-8312.md): Off-by-one error in afs\_pioctl.c in OpenAFS before 1.6.16 might allow local users to cause a denial of service (memory overwrite and system (no CVSS) - [CVE-2016-2860](https://cve.now/CVE-2016-2860.md): The newEntry function in ptserver/ptprocs.c in OpenAFS before 1.6.17 allows remote authenticated users from foreign Kerberos realms to bypas (no CVSS) - [CVE-2016-3993](https://cve.now/CVE-2016-3993.md): Off-by-one error in the \_\_imlib\_MergeUpdate function in lib/updates.c in imlib2 before 1.4.9 allows remote attackers to cause a denial of se (no CVSS) - [CVE-2016-3994](https://cve.now/CVE-2016-3994.md): The GIF loader in imlib2 before 1.4.9 allows remote attackers to cause a denial of service (application crash) or obtain sensitive informati (no CVSS) - [CVE-2016-4024](https://cve.now/CVE-2016-4024.md): Integer overflow in imlib2 before 1.4.9 on 32-bit platforms allows remote attackers to execute arbitrary code via large dimensions in an ima (no CVSS) - [CVE-2016-4536](https://cve.now/CVE-2016-4536.md): The client in OpenAFS before 1.6.17 does not properly initialize the (1) AFSStoreStatus, (2) AFSStoreVolumeStatus, (3) VldbListByAttributes, (no CVSS) - [CVE-2014-9742](https://cve.now/CVE-2014-9742.md): The Miller-Rabin primality check in Botan before 1.10.8 and 1.11.x before 1.11.9 improperly uses a single random base, which makes it easier (no CVSS) - [CVE-2015-5726](https://cve.now/CVE-2015-5726.md): The BER decoder in Botan 0.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (application c (no CVSS) - [CVE-2015-5727](https://cve.now/CVE-2015-5727.md): The BER decoder in Botan 1.10.x before 1.10.10 and 1.11.x before 1.11.19 allows remote attackers to cause a denial of service (memory consum (no CVSS) - [CVE-2015-7827](https://cve.now/CVE-2015-7827.md): Botan before 1.10.13 and 1.11.x before 1.11.22 make it easier for remote attackers to conduct million-message attacks by measuring time diff (no CVSS) - [CVE-2016-1578](https://cve.now/CVE-2016-1578.md): Use-after-free vulnerability in Oxide allows remote attackers to cause a denial of service (application crash) or execute arbitrary code via (no CVSS) - [CVE-2016-1580](https://cve.now/CVE-2016-1580.md): The setup\_snappy\_os\_mounts function in the ubuntu-core-launcher package before 1.0.27.1 improperly determines the mount point of bind mounts (no CVSS) - [CVE-2016-2099](https://cve.now/CVE-2016-2099.md): Use-after-free vulnerability in validators/DTD/DTDScanner.cpp in Apache Xerces C++ 3.1.3 and earlier allows context-dependent attackers to h (no CVSS) - [CVE-2016-2194](https://cve.now/CVE-2016-2194.md): The ressol function in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to cause a denial of service (infinite loop) v (no CVSS) - [CVE-2016-2195](https://cve.now/CVE-2016-2195.md): Integer overflow in the PointGFp constructor in Botan before 1.10.11 and 1.11.x before 1.11.27 allows remote attackers to overwrite memory a (no CVSS) - [CVE-2016-2196](https://cve.now/CVE-2016-2196.md): Heap-based buffer overflow in the P-521 reduction function in Botan 1.11.x before 1.11.27 allows remote attackers to cause a denial of servi (no CVSS) - [CVE-2016-2849](https://cve.now/CVE-2016-2849.md): Botan before 1.10.13 and 1.11.x before 1.11.29 do not use a constant-time algorithm to perform a modular inverse on the signature nonce k, w (no CVSS) - [CVE-2016-2850](https://cve.now/CVE-2016-2850.md): Botan 1.11.x before 1.11.29 does not enforce TLS policy for (1) signature algorithms and (2) ECC curves, which allows remote attackers to co (no CVSS) - [CVE-2010-5326](https://cve.now/CVE-2010-5326.md): The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows r (CVSS 10.0, KEV) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-05-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.