# CVEs published 2016-09-20 22 CVEs were published on September 20, 2016: 0 critical, 0 high. Days are UTC. - [CVE-2016-6802](https://cve.now/CVE-2016-6802.md): Apache Shiro before 1.3.2 allows attackers to bypass intended servlet filters and gain access by leveraging use of a non-root servlet contex (no CVSS, org.apache.shiro:shiro-all ยท org.apache.shiro:shiro-web) - [CVE-2016-6662](https://cve.now/CVE-2016-6662.md): Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before (no CVSS) - [CVE-2015-8915](https://cve.now/CVE-2015-8915.md): bsdcpio in libarchive before 3.2.0 allows remote attackers to cause a denial of service (invalid read and crash) via crafted cpio file. (no CVSS) - [CVE-2015-8916](https://cve.now/CVE-2015-8916.md): bsdtar in libarchive before 3.2.0 returns a success code without filling the entry when the header is a "split file in multivolume RAR," whi (no CVSS) - [CVE-2015-8917](https://cve.now/CVE-2015-8917.md): bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an invalid c (no CVSS) - [CVE-2015-8918](https://cve.now/CVE-2015-8918.md): The archive\_string\_append function in archive\_string.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (cras (no CVSS) - [CVE-2015-8919](https://cve.now/CVE-2015-8919.md): The lha\_read\_file\_extended\_header function in archive\_read\_support\_format\_lha.c in libarchive before 3.2.0 allows remote attackers to cause (no CVSS) - [CVE-2015-8920](https://cve.now/CVE-2015-8920.md): The \_ar\_read\_header function in archive\_read\_support\_format\_ar.c in libarchive before 3.2.0 allows remote attackers to cause a denial of ser (no CVSS) - [CVE-2015-8921](https://cve.now/CVE-2015-8921.md): The ae\_strtofflags function in archive\_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bound (no CVSS) - [CVE-2015-8922](https://cve.now/CVE-2015-8922.md): The read\_CodersInfo function in archive\_read\_support\_format\_7zip.c in libarchive before 3.2.0 allows remote attackers to cause a denial of s (no CVSS) - [CVE-2015-8923](https://cve.now/CVE-2015-8923.md): The process\_extra function in libarchive before 3.2.0 uses the size field and a signed number in an offset, which allows remote attackers to (no CVSS) - [CVE-2015-8924](https://cve.now/CVE-2015-8924.md): The archive\_read\_format\_tar\_read\_header function in archive\_read\_support\_format\_tar.c in libarchive before 3.2.0 allows remote attackers to (no CVSS) - [CVE-2015-8925](https://cve.now/CVE-2015-8925.md): The readline function in archive\_read\_support\_format\_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (no CVSS) - [CVE-2015-8926](https://cve.now/CVE-2015-8926.md): The archive\_read\_format\_rar\_read\_data function in archive\_read\_support\_format\_rar.c in libarchive before 3.2.0 allows remote attackers to ca (no CVSS) - [CVE-2015-8927](https://cve.now/CVE-2015-8927.md): The trad\_enc\_decrypt\_update function in archive\_read\_support\_format\_zip.c in libarchive before 3.2.0 allows remote attackers to cause a deni (no CVSS) - [CVE-2015-8928](https://cve.now/CVE-2015-8928.md): The process\_add\_entry function in archive\_read\_support\_format\_mtree.c in libarchive before 3.2.0 allows remote attackers to cause a denial o (no CVSS) - [CVE-2015-8929](https://cve.now/CVE-2015-8929.md): Memory leak in the \_\_archive\_read\_get\_extract function in archive\_read\_extract2.c in libarchive before 3.2.0 allows remote attackers to caus (no CVSS) - [CVE-2015-8930](https://cve.now/CVE-2015-8930.md): bsdtar in libarchive before 3.2.0 allows remote attackers to cause a denial of service (infinite loop) via an ISO with a directory that is a (no CVSS) - [CVE-2015-8931](https://cve.now/CVE-2015-8931.md): Multiple integer overflows in the (1) get\_time\_t\_max and (2) get\_time\_t\_min functions in archive\_read\_support\_format\_mtree.c in libarchive b (no CVSS) - [CVE-2015-8932](https://cve.now/CVE-2015-8932.md): The compress\_bidder\_init function in archive\_read\_support\_filter\_compress.c in libarchive before 3.2.0 allows remote attackers to cause a de (no CVSS) - [CVE-2015-8933](https://cve.now/CVE-2015-8933.md): Integer overflow in the archive\_read\_format\_tar\_skip function in archive\_read\_support\_format\_tar.c in libarchive before 3.2.0 allows remote (no CVSS) - [CVE-2015-8934](https://cve.now/CVE-2015-8934.md): The copy\_from\_lzss\_window function in archive\_read\_support\_format\_rar.c in libarchive 3.2.0 and earlier allows remote attackers to cause a d (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-09-20 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.