# CVEs published 2016-06-16

94 CVEs were published on June 16, 2016: 0 critical, 2 high. 2 are now in CISA KEV. Days are UTC.

- [CVE-2012-6702](https://cve.now/CVE-2012-6702.md): Expat, when used in a parser that has not called XML\_SetHashSalt or passed it a seed of 0, makes it easier for context-dependent attackers t (no CVSS)
- [CVE-2016-2391](https://cve.now/CVE-2016-2391.md): The ohci\_bus\_start function in the USB OHCI emulation support (hw/usb/hcd-ohci.c) in QEMU allows local guest OS administrators to cause a de (no CVSS)
- [CVE-2016-2392](https://cve.now/CVE-2016-2392.md): The is\_rndis function in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 does not properly validate USB configuratio (no CVSS)
- [CVE-2016-2538](https://cve.now/CVE-2016-2538.md): Multiple integer overflows in the USB Net device emulator (hw/usb/dev-network.c) in QEMU before 2.5.1 allow local guest OS administrators to (no CVSS)
- [CVE-2016-2841](https://cve.now/CVE-2016-2841.md): The ne2000\_receive function in the NE2000 NIC emulation support (hw/net/ne2000.c) in QEMU before 2.5.1 allows local guest OS administrators (no CVSS)
- [CVE-2016-3062](https://cve.now/CVE-2016-3062.md): The mov\_read\_dref function in libavformat/mov.c in Libav before 11.7 and FFmpeg before 0.11 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2016-3687](https://cve.now/CVE-2016-3687.md): Open redirect vulnerability in F5 BIG-IP APM 11.2.1, 11.4.x, 11.5.x, and 11.6.x before 11.6.0 HF6 and Edge Gateway 11.2.1, when using multi- (no CVSS)
- [CVE-2016-5300](https://cve.now/CVE-2016-5300.md): The XML parser in Expat does not use sufficient entropy for hash initialization, which allows context-dependent attackers to cause a denial (no CVSS)
- [CVE-2016-4120](https://cve.now/CVE-2016-4120.md): Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows att (no CVSS)
- [CVE-2016-4121](https://cve.now/CVE-2016-4121.md): Use-after-free vulnerability in Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before (no CVSS)
- [CVE-2016-4122](https://cve.now/CVE-2016-4122.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4123](https://cve.now/CVE-2016-4123.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4124](https://cve.now/CVE-2016-4124.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4125](https://cve.now/CVE-2016-4125.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4126](https://cve.now/CVE-2016-4126.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4127](https://cve.now/CVE-2016-4127.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4128](https://cve.now/CVE-2016-4128.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4129](https://cve.now/CVE-2016-4129.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4130](https://cve.now/CVE-2016-4130.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4131](https://cve.now/CVE-2016-4131.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4132](https://cve.now/CVE-2016-4132.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4133](https://cve.now/CVE-2016-4133.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4134](https://cve.now/CVE-2016-4134.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4135](https://cve.now/CVE-2016-4135.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4136](https://cve.now/CVE-2016-4136.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4137](https://cve.now/CVE-2016-4137.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4138](https://cve.now/CVE-2016-4138.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4139](https://cve.now/CVE-2016-4139.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4140](https://cve.now/CVE-2016-4140.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4141](https://cve.now/CVE-2016-4141.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4142](https://cve.now/CVE-2016-4142.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4143](https://cve.now/CVE-2016-4143.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4144](https://cve.now/CVE-2016-4144.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4145](https://cve.now/CVE-2016-4145.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4146](https://cve.now/CVE-2016-4146.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4147](https://cve.now/CVE-2016-4147.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4148](https://cve.now/CVE-2016-4148.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4149](https://cve.now/CVE-2016-4149.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4150](https://cve.now/CVE-2016-4150.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4151](https://cve.now/CVE-2016-4151.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4152](https://cve.now/CVE-2016-4152.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4153](https://cve.now/CVE-2016-4153.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4154](https://cve.now/CVE-2016-4154.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4155](https://cve.now/CVE-2016-4155.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4156](https://cve.now/CVE-2016-4156.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4157](https://cve.now/CVE-2016-4157.md): Untrusted search path vulnerability in the installer in Adobe Creative Cloud Desktop Application before 3.7.0.272 on Windows allows local us (no CVSS)
- [CVE-2016-4158](https://cve.now/CVE-2016-4158.md): Unquoted Windows search path vulnerability in Adobe Creative Cloud Desktop Application before 3.7.0.272 on Windows allows local users to gai (no CVSS)
- [CVE-2016-4159](https://cve.now/CVE-2016-4159.md): Cross-site scripting (XSS) vulnerability in Adobe ColdFusion 10 before Update 20, 11 before Update 9, and 2016 before Update 2 allows remote (no CVSS)
- [CVE-2016-4160](https://cve.now/CVE-2016-4160.md): Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows att (no CVSS)
- [CVE-2016-4161](https://cve.now/CVE-2016-4161.md): Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows att (no CVSS)
- [CVE-2016-4162](https://cve.now/CVE-2016-4162.md): Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows att (no CVSS)
- [CVE-2016-4163](https://cve.now/CVE-2016-4163.md): Adobe Flash Player before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux allows att (no CVSS)
- [CVE-2016-4164](https://cve.now/CVE-2016-4164.md): Cross-site scripting (XSS) vulnerability in Adobe Brackets before 1.7 allows remote attackers to inject arbitrary web script or HTML via uns (no CVSS)
- [CVE-2016-4165](https://cve.now/CVE-2016-4165.md): The extension manager in Adobe Brackets before 1.7 allows attackers to have an unspecified impact via invalid input. (no CVSS)
- [CVE-2016-4166](https://cve.now/CVE-2016-4166.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer (no CVSS)
- [CVE-2016-4167](https://cve.now/CVE-2016-4167.md): Adobe DNG Software Development Kit (SDK) before 1.4 2016 allows attackers to execute arbitrary code or cause a denial of service (memory cor (no CVSS)
- [CVE-2016-4171](https://cve.now/CVE-2016-4171.md): Unspecified vulnerability in Adobe Flash Player 21.0.0.242 and earlier allows remote attackers to execute arbitrary code via unknown vectors (CVSS 7.8, KEV)
- [CVE-2016-5361](https://cve.now/CVE-2016-5361.md): programs/pluto/ikev1.c in libreswan before 3.17 retransmits in initial-responder states, which allows remote attackers to cause a denial of (no CVSS)
- [CVE-2016-0025](https://cve.now/CVE-2016-0025.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 20 (no CVSS)
- [CVE-2016-0028](https://cve.now/CVE-2016-0028.md): Outlook Web Access (OWA) in Microsoft Exchange Server 2013 SP1, Cumulative Update 11, and Cumulative Update 12 and 2016 Gold and Cumulative (no CVSS)
- [CVE-2016-0199](https://cve.now/CVE-2016-0199.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2016-0200](https://cve.now/CVE-2016-0200.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2016-3198](https://cve.now/CVE-2016-3198.md): Microsoft Edge allows remote attackers to bypass the Content Security Policy (CSP) protection mechanism via a crafted document, aka "Microso (no CVSS)
- [CVE-2016-3199](https://cve.now/CVE-2016-3199.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-3201](https://cve.now/CVE-2016-3201.md): Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to obtain sensit (no CVSS)
- [CVE-2016-3202](https://cve.now/CVE-2016-3202.md): The Microsoft (1) Chakra JavaScript, (2) JScript, and (3) VBScript engines, as used in Microsoft Internet Explorer 10 and 11 and Microsoft E (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-3203](https://cve.now/CVE-2016-3203.md): Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold and 1511, and Microsoft Edge allow remote attackers to execute arbit (no CVSS)
- [CVE-2016-3205](https://cve.now/CVE-2016-3205.md): The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo (no CVSS)
- [CVE-2016-3206](https://cve.now/CVE-2016-3206.md): The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo (no CVSS)
- [CVE-2016-3207](https://cve.now/CVE-2016-3207.md): The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo (no CVSS)
- [CVE-2016-3210](https://cve.now/CVE-2016-3210.md): The Microsoft (1) JScript and (2) VBScript engines, as used in Internet Explorer 11, allow remote attackers to execute arbitrary code or cau (no CVSS)
- [CVE-2016-3211](https://cve.now/CVE-2016-3211.md): Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) (no CVSS)
- [CVE-2016-3212](https://cve.now/CVE-2016-3212.md): The XSS Filter in Microsoft Internet Explorer 9 through 11 does not properly identify JavaScript, which makes it easier for remote attackers (no CVSS)
- [CVE-2016-3213](https://cve.now/CVE-2016-3213.md): The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP (no CVSS)
- [CVE-2016-3214](https://cve.now/CVE-2016-3214.md): The Chakra JavaScript engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corrup (no CVSS, Microsoft.ChakraCore)
- [CVE-2016-3215](https://cve.now/CVE-2016-3215.md): Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 1511, and Microsoft Edge allow remote attackers to obtain sensitive infor (no CVSS)
- [CVE-2016-3216](https://cve.now/CVE-2016-3216.md): GDI32.dll in the Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows (no CVSS)
- [CVE-2016-3218](https://cve.now/CVE-2016-3218.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)
- [CVE-2016-3219](https://cve.now/CVE-2016-3219.md): The kernel-mode driver in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k El (no CVSS)
- [CVE-2016-3220](https://cve.now/CVE-2016-3220.md): atmfd.dll in the Adobe Type Manager Font Driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8 (no CVSS)
- [CVE-2016-3221](https://cve.now/CVE-2016-3221.md): The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)
- [CVE-2016-3222](https://cve.now/CVE-2016-3222.md): Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, ak (no CVSS)
- [CVE-2016-3223](https://cve.now/CVE-2016-3223.md): Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1 (no CVSS)
- [CVE-2016-3225](https://cve.now/CVE-2016-3225.md): The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 (no CVSS)
- [CVE-2016-3226](https://cve.now/CVE-2016-3226.md): Active Directory in Microsoft Windows Server 2008 R2 SP1 and Server 2012 Gold and R2 allows remote authenticated users to cause a denial of (no CVSS)
- [CVE-2016-3227](https://cve.now/CVE-2016-3227.md): Use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arb (no CVSS)
- [CVE-2016-3228](https://cve.now/CVE-2016-3228.md): Microsoft Windows Server 2008 SP2 and R2 SP1 and Windows Server 2012 Gold and R2 allow remote authenticated users to execute arbitrary code (no CVSS)
- [CVE-2016-3230](https://cve.now/CVE-2016-3230.md): The Search component in Microsoft Windows 7, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and W (no CVSS)
- [CVE-2016-3231](https://cve.now/CVE-2016-3231.md): The Standard Collector service in Windows Diagnostics Hub mishandles library loading, which allows local users to gain privileges via a craf (no CVSS)
- [CVE-2016-3232](https://cve.now/CVE-2016-3232.md): The Virtual PCI (VPCI) virtual service provider in Microsoft Windows Server 2012 Gold and R2 allows local users to obtain sensitive informat (no CVSS)
- [CVE-2016-3233](https://cve.now/CVE-2016-3233.md): Microsoft Excel 2007 SP3, Excel 2010 SP2, and Office Compatibility Pack SP3 allow remote attackers to execute arbitrary code via a crafted O (no CVSS)
- [CVE-2016-3234](https://cve.now/CVE-2016-3234.md): Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Office Compatibility Pack SP3, Word Viewer, Word Automation Services on SharePoint (no CVSS)
- [CVE-2016-3235](https://cve.now/CVE-2016-3235.md): Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading (CVSS 7.8, KEV)
- [CVE-2016-3236](https://cve.now/CVE-2016-3236.md): The Web Proxy Auto Discovery (WPAD) protocol implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-06-16
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.