# CVEs published 2016-06-09

12 CVEs were published on June 9, 2016: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-0749](https://cve.now/CVE-2016-0749.md): The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitra (no CVSS)
- [CVE-2016-1581](https://cve.now/CVE-2016-1581.md): LXD before 2.0.2 uses world-readable permissions for /var/lib/lxd/zfs.img when setting up a loop based ZFS pool, which allows local users to (no CVSS)
- [CVE-2016-1582](https://cve.now/CVE-2016-1582.md): LXD before 2.0.2 does not properly set permissions when switching an unprivileged container into privileged mode, which allows local users t (no CVSS)
- [CVE-2016-2150](https://cve.now/CVE-2016-2150.md): SPICE allows local guest OS users to read from or write to arbitrary host memory locations via crafted primary surface parameters, a similar (no CVSS)
- [CVE-2016-4447](https://cve.now/CVE-2016-4447.md): The xmlParseElementDecl function in parser.c in libxml2 before 2.9.4 allows context-dependent attackers to cause a denial of service (heap-b (no CVSS)
- [CVE-2016-4448](https://cve.now/CVE-2016-4448.md): Format string vulnerability in libxml2 before 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vect (no CVSS)
- [CVE-2016-4449](https://cve.now/CVE-2016-4449.md): XML external entity (XXE) vulnerability in the xmlStringLenDecodeEntities function in parser.c in libxml2 before 2.9.4, when not in validati (no CVSS)
- [CVE-2016-2310](https://cve.now/CVE-2016-2310.md): General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches (no CVSS)
- [CVE-2016-4370](https://cve.now/CVE-2016-4370.md): HPE Project and Portfolio Management Center (PPM) 9.2x and 9.3x before 9.32.0002 allows remote authenticated users to execute arbitrary comm (no CVSS)
- [CVE-2016-4510](https://cve.now/CVE-2016-4510.md): The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and r (no CVSS)
- [CVE-2016-4523](https://cve.now/CVE-2016-4523.md): The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service ( (CVSS 7.5, KEV)
- [CVE-2016-4532](https://cve.now/CVE-2016-4532.md): Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote att (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-06-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.