# CVEs published 2016-05-23

28 CVEs were published on May 23, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8558](https://cve.now/CVE-2015-8558.md): The ehci\_process\_itd function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loop (no CVSS)
- [CVE-2016-2855](https://cve.now/CVE-2016-2855.md): The Huawei Mobile Broadband HL Service 22.001.25.00.03 and earlier uses a weak ACL for the MobileBrServ program data directory, which allows (no CVSS)
- [CVE-2016-3664](https://cve.now/CVE-2016-3664.md): Trend Micro Mobile Security for iOS before 3.2.1188 does not verify the X.509 certificate of the mobile application login server, which allo (no CVSS)
- [CVE-2016-3958](https://cve.now/CVE-2016-3958.md): Untrusted search path vulnerability in Go before 1.5.4 and 1.6.x before 1.6.1 on Windows allows local users to gain privileges via a Trojan (no CVSS, stdlib)
- [CVE-2016-3959](https://cve.now/CVE-2016-3959.md): The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big inte (no CVSS, stdlib)
- [CVE-2016-4001](https://cve.now/CVE-2016-4001.md): Buffer overflow in the stellaris\_enet\_receive function in hw/net/stellaris\_enet.c in QEMU, when the Stellaris ethernet controller is configu (no CVSS)
- [CVE-2016-4037](https://cve.now/CVE-2016-4037.md): The ehci\_advance\_state function in hw/usb/hcd-ehci.c in QEMU allows local guest OS administrators to cause a denial of service (infinite loo (no CVSS)
- [CVE-2016-4049](https://cve.now/CVE-2016-4049.md): The bgp\_dump\_routes\_func function in bgpd/bgp\_dump.c in Quagga does not perform size checks when dumping data, which might allow remote atta (no CVSS)
- [CVE-2016-4087](https://cve.now/CVE-2016-4087.md): Huawei S12700 switches with software before V200R008C00SPC500 and S5700 switches with software before V200R005SPH010, when the debug switch (no CVSS)
- [CVE-2016-4576](https://cve.now/CVE-2016-4576.md): Buffer overflow in the Application Specific Packet Filtering (ASPF) functionality in the Huawei IPS Module, NGFW Module, NIP6300, NIP6600, S (no CVSS)
- [CVE-2016-4577](https://cve.now/CVE-2016-4577.md): Buffer overflow in the Smart DNS functionality in the Huawei NGFW Module and Secospace USG6300, USG6500, USG6600, and USG9500 firewalls with (no CVSS)
- [CVE-2016-4782](https://cve.now/CVE-2016-4782.md): Lenovo SHAREit before 3.5.98\_ww on Android before 4.2 allows remote attackers to have unspecified impact via a crafted intent: URL, aka an " (no CVSS)
- [CVE-2016-4783](https://cve.now/CVE-2016-4783.md): Cross-site scripting (XSS) vulnerability in Lenovo SHAREit before 3.5.98\_ww on Android before 4.4 allows remote attackers to inject arbitrar (no CVSS)
- [CVE-2016-4482](https://cve.now/CVE-2016-4482.md): The proc\_connectinfo function in drivers/usb/core/devio.c in the Linux kernel through 4.6 does not initialize a certain data structure, whic (no CVSS)
- [CVE-2016-4485](https://cve.now/CVE-2016-4485.md): The llc\_cmsg\_rcv function in net/llc/af\_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows at (no CVSS)
- [CVE-2016-4486](https://cve.now/CVE-2016-4486.md): The rtnl\_fill\_link\_ifmap function in net/core/rtnetlink.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, whi (no CVSS)
- [CVE-2016-4557](https://cve.now/CVE-2016-4557.md): The replace\_map\_fd\_with\_map\_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data str (no CVSS)
- [CVE-2016-4558](https://cve.now/CVE-2016-4558.md): The BPF subsystem in the Linux kernel before 4.5.5 mishandles reference counts, which allows local users to cause a denial of service (use-a (no CVSS)
- [CVE-2016-4565](https://cve.now/CVE-2016-4565.md): The InfiniBand (aka IB) stack in the Linux kernel before 4.5.3 incorrectly relies on the write system call, which allows local users to caus (no CVSS)
- [CVE-2016-4568](https://cve.now/CVE-2016-4568.md): drivers/media/v4l2-core/videobuf2-v4l2.c in the Linux kernel before 4.5.3 allows local users to cause a denial of service (kernel memory wri (no CVSS)
- [CVE-2016-4569](https://cve.now/CVE-2016-4569.md): The snd\_timer\_user\_params function in sound/core/timer.c in the Linux kernel through 4.6 does not initialize a certain data structure, which (no CVSS)
- [CVE-2016-4578](https://cve.now/CVE-2016-4578.md): sound/core/timer.c in the Linux kernel through 4.6 does not initialize certain r1 data structures, which allows local users to obtain sensit (no CVSS)
- [CVE-2016-4580](https://cve.now/CVE-2016-4580.md): The x25\_negotiate\_facilities function in net/x25/x25\_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain da (no CVSS)
- [CVE-2016-4581](https://cve.now/CVE-2016-4581.md): fs/pnode.c in the Linux kernel before 4.5.4 does not properly traverse a mount propagation tree in a certain case involving a slave mount, w (no CVSS)
- [CVE-2016-4794](https://cve.now/CVE-2016-4794.md): Use-after-free vulnerability in mm/percpu.c in the Linux kernel through 4.6 allows local users to cause a denial of service (BUG) or possibl (no CVSS)
- [CVE-2016-4805](https://cve.now/CVE-2016-4805.md): Use-after-free vulnerability in drivers/net/ppp/ppp\_generic.c in the Linux kernel before 4.5.2 allows local users to cause a denial of servi (no CVSS)
- [CVE-2016-4913](https://cve.now/CVE-2016-4913.md): The get\_rock\_ridge\_filename function in fs/isofs/rock.c in the Linux kernel before 4.5.5 mishandles NM (aka alternate name) entries containi (no CVSS)
- [CVE-2016-4951](https://cve.now/CVE-2016-4951.md): The tipc\_nl\_publ\_dump function in net/tipc/socket.c in the Linux kernel through 4.6 does not verify socket existence, which allows local use (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-05-23
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.