# CVEs published 2016-08-05

84 CVEs were published on August 5, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2014-9901](https://cve.now/CVE-2014-9901.md): The Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) devices makes incorrect snprintf calls, which allows remote attacke (no CVSS)
- [CVE-2014-9902](https://cve.now/CVE-2014-9902.md): Buffer overflow in CORE/SYS/legacy/src/utils/src/dot11f.c in the Qualcomm Wi-Fi driver in Android before 2016-08-05 on Nexus 7 (2013) device (no CVSS)
- [CVE-2016-2497](https://cve.now/CVE-2016-2497.md): services/core/java/com/android/server/pm/PackageManagerService.java in the framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5 (no CVSS)
- [CVE-2016-2504](https://cve.now/CVE-2016-2504.md): The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5, 5X, 6, 6P, and 7 (2013) devices allows attackers to gain privileges via a c (no CVSS)
- [CVE-2016-3819](https://cve.now/CVE-2016-3819.md): Integer overflow in codecs/on2/h264dec/source/h264bsd\_dpb.c in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2 (no CVSS)
- [CVE-2016-3820](https://cve.now/CVE-2016-3820.md): The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 mishandles slice numbers, which allows remote attackers to execute arbitr (no CVSS)
- [CVE-2016-3821](https://cve.now/CVE-2016-3821.md): libmedia in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 has certain incorrect (no CVSS)
- [CVE-2016-3822](https://cve.now/CVE-2016-3822.md): exif.c in Matthias Wandel jhead 2.87, as used in libjhead in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x befor (no CVSS)
- [CVE-2016-3823](https://cve.now/CVE-2016-3823.md): The secure-session feature in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before (no CVSS)
- [CVE-2016-3824](https://cve.now/CVE-2016-3824.md): omx/OMXNodeInstance.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before (no CVSS)
- [CVE-2016-3825](https://cve.now/CVE-2016-3825.md): mm-video-v4l2/vidc/venc/src/omx\_video\_base.cpp in mediaserver in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 a (no CVSS)
- [CVE-2016-3826](https://cve.now/CVE-2016-3826.md): services/audioflinger/Effects.cpp in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08 (no CVSS)
- [CVE-2016-3827](https://cve.now/CVE-2016-3827.md): codecs/hevcdec/SoftHEVC.cpp in libstagefright in mediaserver in Android 6.0.1 before 2016-08-01 mishandles decoder errors, which allows remo (no CVSS)
- [CVE-2016-3828](https://cve.now/CVE-2016-3828.md): decoder/ih264d\_api.c in mediaserver in Android 6.x before 2016-08-01 mishandles invalid PPS and SPS NAL units, which allows remote attackers (no CVSS)
- [CVE-2016-3829](https://cve.now/CVE-2016-3829.md): The ih264d decoder in mediaserver in Android 6.x before 2016-08-01 does not initialize certain structure members, which allows remote attack (no CVSS)
- [CVE-2016-3830](https://cve.now/CVE-2016-3830.md): codecs/aacdec/SoftAAC2.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x bef (no CVSS)
- [CVE-2016-3831](https://cve.now/CVE-2016-3831.md): The telephony component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows remote attacke (no CVSS)
- [CVE-2016-3832](https://cve.now/CVE-2016-3832.md): The framework APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 do not ensure that package (no CVSS)
- [CVE-2016-3833](https://cve.now/CVE-2016-3833.md): The Shell component in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 does not properly manage the MANAGE\_USERS a (no CVSS)
- [CVE-2016-3834](https://cve.now/CVE-2016-3834.md): The camera APIs in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allow attackers to bypass int (no CVSS)
- [CVE-2016-3835](https://cve.now/CVE-2016-3835.md): The secure-session feature in the mm-video-v4l2 venc component in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before (no CVSS)
- [CVE-2016-3836](https://cve.now/CVE-2016-3836.md): The SurfaceFlinger service in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to obtain sensitive (no CVSS)
- [CVE-2016-3837](https://cve.now/CVE-2016-3837.md): service/jni/com\_android\_server\_wifi\_WifiNative.cpp in Wi-Fi in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 all (no CVSS)
- [CVE-2016-3838](https://cve.now/CVE-2016-3838.md): Android 6.x before 2016-08-01 allows attackers to cause a denial of service (loss of locked-screen 911 functionality) via a crafted applicat (no CVSS)
- [CVE-2016-3839](https://cve.now/CVE-2016-3839.md): Bluetooth in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-01 allows attackers to cause a denial (no CVSS)
- [CVE-2016-3840](https://cve.now/CVE-2016-3840.md): Conscrypt in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-08-05 does not properly identify session (no CVSS)
- [CVE-2016-3842](https://cve.now/CVE-2016-3842.md): The Qualcomm GPU driver in Android before 2016-08-05 on Nexus 5X, 6, and 6P devices allows attackers to gain privileges via a crafted applic (no CVSS)
- [CVE-2016-3843](https://cve.now/CVE-2016-3843.md): Android before 2016-08-05 does not properly restrict code execution in a kernel context, which allows attackers to gain privileges via a cra (no CVSS)
- [CVE-2016-3844](https://cve.now/CVE-2016-3844.md): mediaserver in Android before 2016-08-05 on Nexus 9 and Pixel C devices allows attackers to gain privileges via a crafted application, aka i (no CVSS)
- [CVE-2016-3845](https://cve.now/CVE-2016-3845.md): The video driver in the kernel in Android before 2016-08-05 on Nexus 5 devices allows attackers to gain privileges via a crafted application (no CVSS)
- [CVE-2016-3846](https://cve.now/CVE-2016-3846.md): The Serial Peripheral Interface driver in Android before 2016-08-05 on Nexus 5X and 6P devices allows attackers to gain privileges via a cra (no CVSS)
- [CVE-2016-3847](https://cve.now/CVE-2016-3847.md): The NVIDIA media driver in Android before 2016-08-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS)
- [CVE-2016-3848](https://cve.now/CVE-2016-3848.md): The NVIDIA media driver in Android before 2016-08-05 on Nexus 9 devices allows attackers to gain privileges via a crafted application, aka i (no CVSS)
- [CVE-2016-3849](https://cve.now/CVE-2016-3849.md): The ION driver in Android before 2016-08-05 on Pixel C devices allows attackers to gain privileges via a crafted application, aka internal b (no CVSS)
- [CVE-2016-3850](https://cve.now/CVE-2016-3850.md): Integer overflow in app/aboot/aboot.c in the Qualcomm bootloader in Android before 2016-08-05 on Nexus 5, 5X, 6P, and 7 (2013) devices allow (no CVSS)
- [CVE-2016-3851](https://cve.now/CVE-2016-3851.md): The LG Electronics bootloader Android before 2016-08-05 on Nexus 5X devices allows attackers to gain privileges by leveraging access to a pr (no CVSS)
- [CVE-2016-3852](https://cve.now/CVE-2016-3852.md): The MediaTek Wi-Fi driver in Android before 2016-08-05 on Android One devices allows attackers to obtain sensitive information via a crafted (no CVSS)
- [CVE-2016-3853](https://cve.now/CVE-2016-3853.md): Google Play services in Android before 2016-08-05 on Nexus devices allow local users to bypass the Factory Reset Protection protection mecha (no CVSS)
- [CVE-2016-3857](https://cve.now/CVE-2016-3857.md): The kernel in Android before 2016-08-05 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application, aka interna (no CVSS)
- [CVE-2015-8945](https://cve.now/CVE-2015-8945.md): openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials optio (no CVSS)
- [CVE-2016-0782](https://cve.now/CVE-2016-0782.md): The administration web console in Apache ActiveMQ 5.x before 5.11.4, 5.12.x before 5.12.3, and 5.13.x before 5.13.2 allows remote authentica (no CVSS, org.apache.activemq:activemq-client)
- [CVE-2016-1276](https://cve.now/CVE-2016-1276.md): Juniper Junos OS before 12.1X46-D50, 12.1X47 before 12.1X47-D23, 12.3X48 before 12.3X48-D25, and 15.1X49 before 15.1X49-D40 on a High-End SR (no CVSS)
- [CVE-2016-1278](https://cve.now/CVE-2016-1278.md): Juniper Junos OS before 12.1X46-D50 on SRX Series devices reverts to "safe mode" authentication and allows root CLI logins without a passwor (no CVSS)
- [CVE-2016-4999](https://cve.now/CVE-2016-4999.md): SQL injection vulnerability in the getStringParameterSQL method in main/java/org/dashbuilder/dataprovider/sql/dialect/DefaultDialect.java in (no CVSS)
- [CVE-2016-5392](https://cve.now/CVE-2016-5392.md): The API server in Kubernetes, as used in Red Hat OpenShift Enterprise 3.2, in a multi tenant environment allows remote authenticated users w (no CVSS)
- [CVE-2016-6186](https://cve.now/CVE-2016-6186.md): Cross-site scripting (XSS) vulnerability in the dismissChangeRelatedObjectPopup function in contrib/admin/static/admin/js/admin/RelatedObjec (no CVSS, django)
- [CVE-2016-1513](https://cve.now/CVE-2016-1513.md): The Impress tool in Apache OpenOffice 4.1.2 and earlier allows remote attackers to cause a denial of service (out-of-bounds read or write) o (no CVSS)
- [CVE-2016-3080](https://cve.now/CVE-2016-3080.md): Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2016-3097](https://cve.now/CVE-2016-3097.md): Cross-site scripting (XSS) vulnerability in spacewalk-java in Red Hat Satellite 5.7 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2016-3196](https://cve.now/CVE-2016-3196.md): Cross-site scripting (XSS) vulnerability in Fortinet FortiAnalyzer 5.x before 5.0.12 and 5.2.x before 5.2.6 and FortiManager 5.x before 5.0. (no CVSS)
- [CVE-2016-3640](https://cve.now/CVE-2016-3640.md): The Extended Application Services (aka XS or XS Engine) in SAP HANA DB 1.00.091.00.1418659308 allows local users to obtain sensitive passwor (no CVSS)
- [CVE-2016-5000](https://cve.now/CVE-2016-5000.md): The XLSX2CSV example in Apache POI before 3.14 allows remote attackers to read arbitrary files via a crafted OpenXML document containing an (no CVSS, org.apache.poi:poi-examples)
- [CVE-2016-6138](https://cve.now/CVE-2016-6138.md): Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka (no CVSS)
- [CVE-2016-6139](https://cve.now/CVE-2016-6139.md): SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, aka SAP Security Note 2203591. (no CVSS)
- [CVE-2016-6140](https://cve.now/CVE-2016-6140.md): SAP TREX 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, aka SAP Security Note 2203 (no CVSS)
- [CVE-2016-6144](https://cve.now/CVE-2016-6144.md): The SQL interface in SAP HANA before Revision 102 does not limit the number of login attempts for the SYSTEM user when the password\_lock\_for (no CVSS)
- [CVE-2016-6145](https://cve.now/CVE-2016-6145.md): The SQL interface in SAP HANA DB 1.00.091.00.1418659308 provides different error messages for failed login attempts depending on whether the (no CVSS)
- [CVE-2016-6147](https://cve.now/CVE-2016-6147.md): An unspecified interface in SAP TREX 7.10 Revision 63 allows remote attackers to execute arbitrary OS commands with SIDadm privileges via un (no CVSS)
- [CVE-2016-6148](https://cve.now/CVE-2016-6148.md): SAP HANA DB 1.00.73.00.389160 allows remote attackers to cause a denial of service (process termination) or execute arbitrary code via vecto (no CVSS)
- [CVE-2016-6149](https://cve.now/CVE-2016-6149.md): SAP HANA SPS09 1.00.091.00.14186593 allows local users to obtain sensitive information by leveraging the EXPORT statement to export files, a (no CVSS)
- [CVE-2016-6150](https://cve.now/CVE-2016-6150.md): The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass in (no CVSS)
- [CVE-2016-2830](https://cve.now/CVE-2016-2830.md): Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 preserve the network connection used for favicon resource retrieval after the a (no CVSS)
- [CVE-2016-2835](https://cve.now/CVE-2016-2835.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 allow remote attackers to cause a denial of servic (no CVSS)
- [CVE-2016-2836](https://cve.now/CVE-2016-2836.md): Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow remote atta (no CVSS)
- [CVE-2016-2837](https://cve.now/CVE-2016-2837.md): Heap-based buffer overflow in the ClearKey Content Decryption Module (CDM) in the Encrypted Media Extensions (EME) API in Mozilla Firefox be (no CVSS)
- [CVE-2016-2838](https://cve.now/CVE-2016-2838.md): Heap-based buffer overflow in the nsBidi::BracketData::AddOpening function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 a (no CVSS)
- [CVE-2016-2839](https://cve.now/CVE-2016-2839.md): Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 on Linux make cairo \_cairo\_surface\_get\_extents calls that do not properly inter (no CVSS)
- [CVE-2016-5250](https://cve.now/CVE-2016-5250.md): Mozilla Firefox before 48.0, Firefox ESR \< 45.4 and Thunderbird \< 45.4 allow remote attackers to obtain sensitive information about the prev (no CVSS)
- [CVE-2016-5251](https://cve.now/CVE-2016-5251.md): Mozilla Firefox before 48.0 allows remote attackers to spoof the location bar via crafted characters in the media type of a data: URL. (no CVSS)
- [CVE-2016-5252](https://cve.now/CVE-2016-5252.md): Stack-based buffer underflow in the mozilla::gfx::BasePoint4d function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow (no CVSS)
- [CVE-2016-5253](https://cve.now/CVE-2016-5253.md): The Updater in Mozilla Firefox before 48.0 on Windows allows local users to write to arbitrary files via vectors involving the callback appl (no CVSS)
- [CVE-2016-5254](https://cve.now/CVE-2016-5254.md): Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allo (no CVSS)
- [CVE-2016-5255](https://cve.now/CVE-2016-5255.md): Use-after-free vulnerability in the js::PreliminaryObjectArray::sweep function in Mozilla Firefox before 48.0 allows remote attackers to exe (no CVSS)
- [CVE-2016-5258](https://cve.now/CVE-2016-5258.md): Use-after-free vulnerability in the WebRTC socket thread in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows remote attac (no CVSS)
- [CVE-2016-5259](https://cve.now/CVE-2016-5259.md): Use-after-free vulnerability in the CanonicalizeXPCOMParticipant function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 al (no CVSS)
- [CVE-2016-5260](https://cve.now/CVE-2016-5260.md): Mozilla Firefox before 48.0 mishandles changes from 'INPUT type="password"' to 'INPUT type="text"' within a single Session Manager session, (no CVSS)
- [CVE-2016-5261](https://cve.now/CVE-2016-5261.md): Integer overflow in the WebSocketChannel class in the WebSockets subsystem in Mozilla Firefox before 48.0 and Firefox ESR \< 45.4 allows remo (no CVSS)
- [CVE-2016-5262](https://cve.now/CVE-2016-5262.md): Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 process JavaScript event-handler attributes of a MARQUEE element within a sandb (no CVSS)
- [CVE-2016-5263](https://cve.now/CVE-2016-5263.md): The nsDisplayList::HitTest function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 mishandles rendering display transformat (no CVSS)
- [CVE-2016-5264](https://cve.now/CVE-2016-5264.md): Use-after-free vulnerability in the nsNodeUtils::NativeAnonymousChildListChange function in Mozilla Firefox before 48.0 and Firefox ESR 45.x (no CVSS)
- [CVE-2016-5265](https://cve.now/CVE-2016-5265.md): Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allow user-assisted remote attackers to bypass the Same Origin Policy, and cond (no CVSS)
- [CVE-2016-5266](https://cve.now/CVE-2016-5266.md): Mozilla Firefox before 48.0 does not properly restrict drag-and-drop (aka dataTransfer) actions for file: URIs, which allows user-assisted r (no CVSS)
- [CVE-2016-5267](https://cve.now/CVE-2016-5267.md): Mozilla Firefox before 48.0 on Android allows remote attackers to spoof the address bar via left-to-right characters in conjunction with a r (no CVSS)
- [CVE-2016-5268](https://cve.now/CVE-2016-5268.md): Mozilla Firefox before 48.0 does not properly set the LINKABLE and URI\_SAFE\_FOR\_UNTRUSTED\_CONTENT flags of about: URLs that are used for err (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-08-05
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.