# CVEs published 2016-06-07

21 CVEs were published on June 7, 2016: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2013-7440](https://cve.now/CVE-2013-7440.md): The ssl.match\_hostname function in CPython (aka Python) before 2.7.9 and 3.x before 3.3.3 does not properly handle wildcards in hostnames, w (no CVSS)
- [CVE-2016-3072](https://cve.now/CVE-2016-3072.md): Multiple SQL injection vulnerabilities in the scoped\_search function in app/controllers/katello/api/v2/api\_controller.rb in Katello allow re (no CVSS, katello)
- [CVE-2016-3087](https://cve.now/CVE-2016-3087.md): Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attacker (no CVSS, org.apache.struts:struts2-core)
- [CVE-2016-3093](https://cve.now/CVE-2016-3093.md): Apache Struts 2.0.0 through 2.3.24.1 does not properly cache method references when used with OGNL before 3.0.12, which allows remote attack (no CVSS, org.apache.struts:struts2-core · ognl:ognl)
- [CVE-2016-4545](https://cve.now/CVE-2016-4545.md): Virtual servers in F5 BIG-IP 11.5.4, when SSL profiles are enabled, allow remote attackers to cause a denial of service (resource consumptio (no CVSS)
- [CVE-2014-8177](https://cve.now/CVE-2014-8177.md): The Red Hat gluster-swift package, as used in Red Hat Gluster Storage (formerly Red Hat Storage Server), allows remote authenticated users t (no CVSS)
- [CVE-2014-9746](https://cve.now/CVE-2014-9746.md): The (1) t1\_parse\_font\_matrix function in type1/t1load.c, (2) cid\_parse\_font\_matrix function in cid/cidload.c, (3) t42\_parse\_font\_matrix func (no CVSS)
- [CVE-2014-9747](https://cve.now/CVE-2014-9747.md): The t42\_parse\_encoding function in type42/t42parse.c in FreeType before 2.5.4 does not properly update the current position for immediates-o (no CVSS)
- [CVE-2015-5228](https://cve.now/CVE-2015-5228.md): The service daemon in CRIU creates log and dump files insecurely, which allows local users to create arbitrary files and take ownership of e (no CVSS)
- [CVE-2015-5231](https://cve.now/CVE-2015-5231.md): The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive informa (no CVSS)
- [CVE-2015-5260](https://cve.now/CVE-2015-5260.md): Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to cause a denial of service (heap-based memory corruption and QEMU- (no CVSS)
- [CVE-2015-5261](https://cve.now/CVE-2015-5261.md): Heap-based buffer overflow in SPICE before 0.12.6 allows guest OS users to read and write to arbitrary memory locations on the host via gues (no CVSS)
- [CVE-2015-5723](https://cve.now/CVE-2015-5723.md): Doctrine Annotations before 1.2.7, Cache before 1.3.2 and 1.4.x before 1.4.2, Common before 2.4.3 and 2.5.x before 2.5.1, ORM before 2.4.8 o (no CVSS, doctrine/annotations · doctrine/cache +9)
- [CVE-2015-7611](https://cve.now/CVE-2015-7611.md): Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary system commands via unsp (no CVSS, org.apache.james:james-server)
- [CVE-2015-7695](https://cve.now/CVE-2015-7695.md): The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitr (no CVSS, zendframework/zendframework1)
- [CVE-2016-2335](https://cve.now/CVE-2016-2335.md): The CInArchive::ReadFileItem method in Archive/Udf/UdfIn.cpp in 7zip 9.20 and 15.05 beta and p7zip allows remote attackers to cause a denial (no CVSS)
- [CVE-2016-4437](https://cve.now/CVE-2016-4437.md): Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attackers to execute arbit (CVSS 9.8, KEV, org.apache.shiro:shiro-core)
- [CVE-2016-4450](https://cve.now/CVE-2016-4450.md): os/unix/ngx\_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer deref (no CVSS)
- [CVE-2016-4962](https://cve.now/CVE-2016-4962.md): The libxl device-handling in Xen 4.6.x and earlier allows local OS guest administrators to cause a denial of service (resource consumption o (no CVSS)
- [CVE-2016-4963](https://cve.now/CVE-2016-4963.md): The libxl device-handling in Xen through 4.6.x allows local guest OS users with access to the driver domain to cause a denial of service (ma (no CVSS)
- [CVE-2016-5242](https://cve.now/CVE-2016-5242.md): The p2m\_teardown function in arch/arm/p2m.c in Xen 4.4.x through 4.6.x allows local guest OS users with access to the driver domain to cause (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-06-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.