# CVEs published 2016-06-13 74 CVEs were published on June 13, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2014-9773](https://cve.now/CVE-2014-9773.md): modules/chanserv/flags.c in Atheme before 7.2.7 allows remote attackers to modify the Anope FLAGS behavior by registering and dropping the ( (no CVSS) - [CVE-2015-8869](https://cve.now/CVE-2015-8869.md): OCaml before 4.03.0 does not properly handle sign extensions, which allows remote attackers to conduct buffer overflow attacks or obtain sen (no CVSS) - [CVE-2016-3698](https://cve.now/CVE-2016-3698.md): libndp before 1.6, as used in NetworkManager, does not properly validate the origin of Neighbor Discovery Protocol (NDP) messages, which all (no CVSS) - [CVE-2016-4353](https://cve.now/CVE-2016-4353.md): ber-decoder.c in Libksba before 1.3.3 does not properly handle decoder stack overflows, which allows remote attackers to cause a denial of s (no CVSS) - [CVE-2016-4354](https://cve.now/CVE-2016-4354.md): ber-decoder.c in Libksba before 1.3.3 uses an incorrect integer data type, which allows remote attackers to cause a denial of service (crash (no CVSS) - [CVE-2016-4355](https://cve.now/CVE-2016-4355.md): Multiple integer overflows in ber-decoder.c in Libksba before 1.3.3 allow remote attackers to cause a denial of service (crash) via crafted (no CVSS) - [CVE-2016-4356](https://cve.now/CVE-2016-4356.md): The append\_utf8\_value function in the DN decoder (dn.c) in Libksba before 1.3.3 allows remote attackers to cause a denial of service (out-of (no CVSS) - [CVE-2016-4414](https://cve.now/CVE-2016-4414.md): The onReadyRead function in core/coreauthhandler.cpp in Quassel before 0.12.4 allows remote attackers to cause a denial of service (NULL poi (no CVSS) - [CVE-2016-4478](https://cve.now/CVE-2016-4478.md): Buffer overflow in the xmlrpc\_char\_encode function in modules/transport/xmlrpc/xmlrpclib.c in Atheme before 7.2.7 allows remote attackers to (no CVSS) - [CVE-2016-4574](https://cve.now/CVE-2016-4574.md): Off-by-one error in the append\_utf8\_value function in the DN decoder (dn.c) in Libksba before 1.3.4 allows remote attackers to cause a denia (no CVSS) - [CVE-2016-4579](https://cve.now/CVE-2016-4579.md): Libksba before 1.3.4 allows remote attackers to cause a denial of service (out-of-bounds read and crash) via unspecified vectors, related to (no CVSS) - [CVE-2016-1542](https://cve.now/CVE-2016-1542.md): The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote at (no CVSS) - [CVE-2016-1543](https://cve.now/CVE-2016-1543.md): The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remot (no CVSS) - [CVE-2016-2174](https://cve.now/CVE-2016-2174.md): SQL injection vulnerability in the policy admin tool in Apache Ranger before 0.5.3 allows remote authenticated administrators to execute arb (no CVSS, org.apache.ranger:ranger) - [CVE-2016-3670](https://cve.now/CVE-2016-3670.md): Cross-site scripting (XSS) vulnerability in users.jsp in the Profile Search functionality in Liferay before 7.0.0 CE RC1 allows remote attac (no CVSS, com.liferay:com.liferay.portal.search.web) - [CVE-2016-3677](https://cve.now/CVE-2016-3677.md): The Huawei Wear App application before 15.0.0.307 for Android does not validate SSL certificates, which allows local users to have unspecifi (no CVSS) - [CVE-2016-4005](https://cve.now/CVE-2016-4005.md): The Huawei Hilink App application before 3.19.2 for Android does not validate SSL certificates, which allows local users to have unspecified (no CVSS) - [CVE-2016-4911](https://cve.now/CVE-2016-4911.md): The Fernet Token Provider in OpenStack Identity (Keystone) 9.0.x before 9.0.1 (mitaka) allows remote authenticated users to prevent revocati (no CVSS, keystone) - [CVE-2016-5104](https://cve.now/CVE-2016-5104.md): The socket\_create function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restricti (no CVSS) - [CVE-2016-5234](https://cve.now/CVE-2016-5234.md): Buffer overflow in Huawei VP9660, VP9650, and VP9630 multipoint control unit devices with software before V500R002C00SPC200 and RSE6500 vide (no CVSS) - [CVE-2016-5302](https://cve.now/CVE-2016-5302.md): Citrix XenServer 7.0 before Hotfix XS70E003, when a deployment has been upgraded from an earlier release, might allow remote attackers on th (no CVSS) - [CVE-2016-2815](https://cve.now/CVE-2016-2815.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 allow remote attackers to cause a denial of servic (no CVSS) - [CVE-2016-2818](https://cve.now/CVE-2016-2818.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote atta (no CVSS) - [CVE-2016-2819](https://cve.now/CVE-2016-2819.md): Heap-based buffer overflow in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary code (no CVSS) - [CVE-2016-2821](https://cve.now/CVE-2016-2821.md): Use-after-free vulnerability in the mozilla::dom::Element class in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2, when conten (no CVSS) - [CVE-2016-2822](https://cve.now/CVE-2016-2822.md): Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allow remote attackers to spoof the address bar via a SELECT element with a per (no CVSS) - [CVE-2016-2824](https://cve.now/CVE-2016-2824.md): The TSymbolTableLevel class in ANGLE, as used in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows, allows remote atta (no CVSS) - [CVE-2016-2825](https://cve.now/CVE-2016-2825.md): Mozilla Firefox before 47.0 allows remote attackers to bypass the Same Origin Policy and modify the location.host property via an invalid da (no CVSS) - [CVE-2016-2826](https://cve.now/CVE-2016-2826.md): The maintenance service in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 on Windows does not prevent MAR extracted-file modif (no CVSS) - [CVE-2016-2828](https://cve.now/CVE-2016-2828.md): Use-after-free vulnerability in Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 allows remote attackers to execute arbitrary co (no CVSS) - [CVE-2016-2829](https://cve.now/CVE-2016-2829.md): Mozilla Firefox before 47.0 allows remote attackers to spoof permission notifications via a crafted web site that rapidly triggers permissio (no CVSS) - [CVE-2016-2831](https://cve.now/CVE-2016-2831.md): Mozilla Firefox before 47.0 and Firefox ESR 45.x before 45.2 do not ensure that the user approves the fullscreen and pointerlock settings, w (no CVSS) - [CVE-2016-2832](https://cve.now/CVE-2016-2832.md): Mozilla Firefox before 47.0 allows remote attackers to discover the list of disabled plugins via a fingerprinting attack involving Cascading (no CVSS) - [CVE-2016-2833](https://cve.now/CVE-2016-2833.md): Mozilla Firefox before 47.0 ignores Content Security Policy (CSP) directives for cross-domain Java applets, which makes it easier for remote (no CVSS) - [CVE-2016-2834](https://cve.now/CVE-2016-2834.md): Mozilla Network Security Services (NSS) before 3.23, as used in Mozilla Firefox before 47.0, allows remote attackers to cause a denial of se (no CVSS) - [CVE-2016-2061](https://cve.now/CVE-2016-2061.md): Integer signedness error in the MSM V4L2 video driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contrib (no CVSS) - [CVE-2016-2066](https://cve.now/CVE-2016-2066.md): Integer signedness error in the MSM QDSP6 audio driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contri (no CVSS) - [CVE-2016-2463](https://cve.now/CVE-2016-2463.md): Multiple integer overflows in the h264dec component in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x (no CVSS) - [CVE-2016-2464](https://cve.now/CVE-2016-2464.md): libvpx in libwebm in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows remot (no CVSS) - [CVE-2016-2465](https://cve.now/CVE-2016-2465.md): The Qualcomm video driver in Android before 2016-06-01 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted a (no CVSS) - [CVE-2016-2466](https://cve.now/CVE-2016-2466.md): The Qualcomm sound driver in Android before 2016-06-01 on Nexus 6 devices allows attackers to gain privileges via a crafted application, aka (no CVSS) - [CVE-2016-2467](https://cve.now/CVE-2016-2467.md): The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5 devices allows attackers to gain privileges via a crafted application, aka (no CVSS) - [CVE-2016-2468](https://cve.now/CVE-2016-2468.md): The Qualcomm GPU driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 devices allows attackers to gain privileges via a crafted (no CVSS) - [CVE-2016-2469](https://cve.now/CVE-2016-2469.md): The Qualcomm sound driver in Android before 2016-06-01 on Nexus 5, 6, and 6P devices allows attackers to gain privileges via a crafted appli (no CVSS) - [CVE-2016-2470](https://cve.now/CVE-2016-2470.md): The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted applicati (no CVSS) - [CVE-2016-2471](https://cve.now/CVE-2016-2471.md): The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted applicati (no CVSS) - [CVE-2016-2472](https://cve.now/CVE-2016-2472.md): The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted applicati (no CVSS) - [CVE-2016-2473](https://cve.now/CVE-2016-2473.md): The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted applicati (no CVSS) - [CVE-2016-2474](https://cve.now/CVE-2016-2474.md): The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 5X devices allows attackers to gain privileges via a crafted application, ak (no CVSS) - [CVE-2016-2475](https://cve.now/CVE-2016-2475.md): The Broadcom Wi-Fi driver in Android before 2016-06-01 on Nexus 5, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus 9, Nexus Player, and Pixel C dev (no CVSS) - [CVE-2016-2476](https://cve.now/CVE-2016-2476.md): mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not validate OMX buffer size (no CVSS) - [CVE-2016-2477](https://cve.now/CVE-2016-2477.md): mm-video-v4l2/vidc/vdec/src/omx\_vdec\_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x (no CVSS) - [CVE-2016-2478](https://cve.now/CVE-2016-2478.md): mm-video-v4l2/vidc/vdec/src/omx\_vdec\_msm8974.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x (no CVSS) - [CVE-2016-2479](https://cve.now/CVE-2016-2479.md): The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06- (no CVSS) - [CVE-2016-2480](https://cve.now/CVE-2016-2480.md): The mm-video-v4l2 vidc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06- (no CVSS) - [CVE-2016-2481](https://cve.now/CVE-2016-2481.md): The mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06- (no CVSS) - [CVE-2016-2482](https://cve.now/CVE-2016-2482.md): The mm-video-v4l2 vdec component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06- (no CVSS) - [CVE-2016-2483](https://cve.now/CVE-2016-2483.md): The mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06- (no CVSS) - [CVE-2016-2484](https://cve.now/CVE-2016-2484.md): libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not valida (no CVSS) - [CVE-2016-2485](https://cve.now/CVE-2016-2485.md): libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not valida (no CVSS) - [CVE-2016-2486](https://cve.now/CVE-2016-2486.md): mp3dec/SoftMP3.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016 (no CVSS) - [CVE-2016-2487](https://cve.now/CVE-2016-2487.md): libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows attacker (no CVSS) - [CVE-2016-2488](https://cve.now/CVE-2016-2488.md): The Qualcomm camera driver in Android before 2016-06-01 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via (no CVSS) - [CVE-2016-2489](https://cve.now/CVE-2016-2489.md): The Qualcomm video driver in Android before 2016-06-01 on Nexus 5, 5X, 6, and 6P devices allows attackers to gain privileges via a crafted a (no CVSS) - [CVE-2016-2490](https://cve.now/CVE-2016-2490.md): The NVIDIA camera driver in Android before 2016-06-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka (no CVSS) - [CVE-2016-2491](https://cve.now/CVE-2016-2491.md): The NVIDIA camera driver in Android before 2016-06-01 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka (no CVSS) - [CVE-2016-2492](https://cve.now/CVE-2016-2492.md): The MediaTek power-management driver in Android before 2016-06-01 on Android One devices allows attackers to gain privileges via a crafted a (no CVSS) - [CVE-2016-2493](https://cve.now/CVE-2016-2493.md): The Broadcom Wi-Fi driver in Android before 2016-06-01 on Nexus 5, Nexus 6, Nexus 6P, Nexus 7 (2013), Nexus Player, and Pixel C devices allo (no CVSS) - [CVE-2016-2494](https://cve.now/CVE-2016-2494.md): Off-by-one error in sdcard/sdcard.c in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 allows at (no CVSS) - [CVE-2016-2495](https://cve.now/CVE-2016-2495.md): SampleTable.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06 (no CVSS) - [CVE-2016-2496](https://cve.now/CVE-2016-2496.md): The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access (no CVSS) - [CVE-2016-2498](https://cve.now/CVE-2016-2498.md): The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to bypass intended data-access restriction (no CVSS) - [CVE-2016-2499](https://cve.now/CVE-2016-2499.md): AudioSource.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06 (no CVSS) - [CVE-2016-2500](https://cve.now/CVE-2016-2500.md): Activity Manager in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-06-01 does not properly terminate process groups, wh (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-06-13 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.