# CVEs published 2016-06-01 17 CVEs were published on June 1, 2016: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC. - [CVE-2015-8875](https://cve.now/CVE-2015-8875.md): Multiple integer overflows in the (1) pixops\_composite\_nearest, (2) pixops\_composite\_color\_nearest, and (3) pixops\_process functions in pixo (no CVSS) - [CVE-2016-1902](https://cve.now/CVE-2016-1902.md): The nextBytes function in the SecureRandom class in Symfony before 2.3.37, 2.6.x before 2.6.13, and 2.7.x before 2.7.9 does not properly gen (no CVSS, symfony/security-core · symfony/security +1) - [CVE-2016-4423](https://cve.now/CVE-2016-4423.md): The attemptAuthentication function in Component/Security/Http/Firewall/UsernamePasswordFormAuthenticationListener.php in Symfony before 2.3. (no CVSS, symfony/security-http · symfony/security +1) - [CVE-2016-4453](https://cve.now/CVE-2016-4453.md): The vmsvga\_fifo\_run function in hw/display/vmware\_vga.c in QEMU allows local guest OS administrators to cause a denial of service (infinite (no CVSS) - [CVE-2016-4454](https://cve.now/CVE-2016-4454.md): The vmsvga\_fifo\_read\_raw function in hw/display/vmware\_vga.c in QEMU allows local guest OS administrators to obtain sensitive host memory in (no CVSS) - [CVE-2016-4810](https://cve.now/CVE-2016-4810.md): Citrix Studio before 7.6.1000, Citrix XenDesktop 7.x before 7.6 LTSR Cumulative Update 1 (CU1), and Citrix XenApp 7.5 and 7.6 allow attacker (no CVSS) - [CVE-2016-4945](https://cve.now/CVE-2016-4945.md): Cross-site scripting (XSS) vulnerability in vpn/js/gateway\_login\_form\_view.js in Citrix NetScaler Gateway 11.0 before Build 66.11 allows rem (no CVSS) - [CVE-2016-5126](https://cve.now/CVE-2016-5126.md): Heap-based buffer overflow in the iscsi\_aio\_ioctl function in block/iscsi.c in QEMU allows local guest OS users to cause a denial of service (no CVSS) - [CVE-2016-1234](https://cve.now/CVE-2016-1234.md): Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB\_ALTDIRFUNC is used, allows contex (no CVSS) - [CVE-2016-2175](https://cve.now/CVE-2016-2175.md): Apache PDFBox before 1.8.12 and 2.x before 2.0.1 does not properly initialize the XML parsers, which allows context-dependent attackers to c (no CVSS, org.apache.pdfbox:pdfbox) - [CVE-2016-3075](https://cve.now/CVE-2016-3075.md): Stack-based buffer overflow in the nss\_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows conte (no CVSS) - [CVE-2016-3088](https://cve.now/CVE-2016-3088.md): The Fileserver web application in Apache ActiveMQ 5.x before 5.14.0 allows remote attackers to upload and execute arbitrary files via an HTT (CVSS 9.8, KEV, org.apache.activemq:activemq-client) - [CVE-2016-3094](https://cve.now/CVE-2016-3094.md): PlainSaslServer.java in Apache Qpid Java before 6.0.3, when the broker is configured to allow plaintext passwords, allows remote attackers t (no CVSS, org.apache.qpid:qpid-broker) - [CVE-2016-3697](https://cve.now/CVE-2016-3697.md): libcontainer/user/user.go in runC before 0.1.0, as used in Docker before 1.11.2, improperly treats a numeric UID as a potential username, wh (no CVSS, github.com/opencontainers/runc) - [CVE-2016-4432](https://cve.now/CVE-2016-4432.md): The AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authentication (no CVSS, org.apache.qpid:qpid-broker-plugins-amqp-0-8-protocol · org…) - [CVE-2016-0288](https://cve.now/CVE-2016-0288.md): IBM Security AppScan Standard 8.7.x, 8.8.x, and 9.x before 9.0.3.2 and Security AppScan Enterprise allow remote authenticated users to read (no CVSS) - [CVE-2016-4500](https://cve.now/CVE-2016-4500.md): Moxa UC-7408 LX-Plus devices allow remote authenticated users to write to the firmware, and consequently render a device unusable, by levera (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-06-01 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.