# CVEs published 2016-09-25

77 CVEs were published on September 25, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-5169](https://cve.now/CVE-2016-5169.md): Format string vulnerability in Google Chrome OS before 53.0.2785.103 allows remote attackers to cause a denial of service or possibly have u (no CVSS)
- [CVE-2016-5170](https://cve.now/CVE-2016-5170.md): WebKit/Source/bindings/modules/v8/V8BindingForModules.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not properly conside (no CVSS)
- [CVE-2016-5171](https://cve.now/CVE-2016-5171.md): WebKit/Source/bindings/templates/interface.cpp in Blink, as used in Google Chrome before 53.0.2785.113, does not prevent certain constructor (no CVSS)
- [CVE-2016-5172](https://cve.now/CVE-2016-5172.md): The parser in Google V8, as used in Google Chrome before 53.0.2785.113, mishandles scopes, which allows remote attackers to obtain sensitive (no CVSS)
- [CVE-2016-5173](https://cve.now/CVE-2016-5173.md): The extensions subsystem in Google Chrome before 53.0.2785.113 does not properly restrict access to Object.prototype, which allows remote at (no CVSS)
- [CVE-2016-5174](https://cve.now/CVE-2016-5174.md): browser/ui/cocoa/browser\_window\_controller\_private.mm in Google Chrome before 53.0.2785.113 does not process fullscreen toggle requests duri (no CVSS)
- [CVE-2016-5175](https://cve.now/CVE-2016-5175.md): Multiple unspecified vulnerabilities in Google Chrome before 53.0.2785.113 allow attackers to cause a denial of service or possibly have oth (no CVSS)
- [CVE-2016-7549](https://cve.now/CVE-2016-7549.md): Google Chrome before 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget, which (no CVSS)
- [CVE-2016-4611](https://cve.now/CVE-2016-4611.md): WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of s (no CVSS)
- [CVE-2016-4618](https://cve.now/CVE-2016-4618.md): Cross-site scripting (XSS) vulnerability in Safari Reader in Apple iOS before 10 and Safari before 10 allows remote attackers to inject arbi (no CVSS)
- [CVE-2016-4658](https://cve.now/CVE-2016-4658.md): xpointer.c in libxml2 before 2.9.5 (as used in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3, and other produ (no CVSS, nokogiri)
- [CVE-2016-4694](https://cve.now/CVE-2016-4694.md): The Apache HTTP Server in Apple OS X before 10.12 and OS X Server before 5.2 follows RFC 3875 section 4.1.18 and therefore does not protect (no CVSS)
- [CVE-2016-4696](https://cve.now/CVE-2016-4696.md): AppleEFIRuntime in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service ( (no CVSS)
- [CVE-2016-4697](https://cve.now/CVE-2016-4697.md): Apple HSSPI Support in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of servi (no CVSS)
- [CVE-2016-4698](https://cve.now/CVE-2016-4698.md): AppleMobileFileIntegrity in Apple iOS before 10 and OS X before 10.12 mishandles process entitlement and Team ID values in the task port inh (no CVSS)
- [CVE-2016-4699](https://cve.now/CVE-2016-4699.md): AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory (no CVSS)
- [CVE-2016-4700](https://cve.now/CVE-2016-4700.md): AppleUUC in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory (no CVSS)
- [CVE-2016-4701](https://cve.now/CVE-2016-4701.md): Application Firewall in Apple OS X before 10.12 allows local users to cause a denial of service via vectors involving a crafted SO\_EXECPATH (no CVSS)
- [CVE-2016-4702](https://cve.now/CVE-2016-4702.md): Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or c (no CVSS)
- [CVE-2016-4703](https://cve.now/CVE-2016-4703.md): Bluetooth in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory (no CVSS)
- [CVE-2016-4706](https://cve.now/CVE-2016-4706.md): cd9660 in Apple OS X before 10.12 allows local users to cause a denial of service via unspecified vectors. (no CVSS)
- [CVE-2016-4707](https://cve.now/CVE-2016-4707.md): CFNetwork in Apple iOS before 10 and OS X before 10.12 mishandles Local Storage deletion, which allows local users to discover the visited w (no CVSS)
- [CVE-2016-4708](https://cve.now/CVE-2016-4708.md): CFNetwork in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 misparses the Set-Cookie header, which allows remo (no CVSS)
- [CVE-2016-4709](https://cve.now/CVE-2016-4709.md): WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vul (no CVSS)
- [CVE-2016-4710](https://cve.now/CVE-2016-4710.md): WindowServer in Apple OS X before 10.12 allows local users to obtain root access via vectors that leverage "type confusion," a different vul (no CVSS)
- [CVE-2016-4711](https://cve.now/CVE-2016-4711.md): CCrypt in corecrypto in CommonCrypto in Apple iOS before 10 and OS X before 10.12 allows attackers to discover cleartext information by leve (no CVSS)
- [CVE-2016-4712](https://cve.now/CVE-2016-4712.md): CoreCrypto in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code or cau (no CVSS)
- [CVE-2016-4713](https://cve.now/CVE-2016-4713.md): CoreDisplay in Apple OS X before 10.12 allows attackers to view arbitrary users' screens by leveraging screen-sharing access. (no CVSS)
- [CVE-2016-4715](https://cve.now/CVE-2016-4715.md): The Date & Time Pref Pane component in Apple OS X before 10.12 mishandles the .GlobalPreferences file, which allows attackers to discover a (no CVSS)
- [CVE-2016-4716](https://cve.now/CVE-2016-4716.md): diskutil in DiskArbitration in Apple OS X before 10.12 allows local users to gain privileges via unspecified vectors. (no CVSS)
- [CVE-2016-4717](https://cve.now/CVE-2016-4717.md): The File Bookmark component in Apple OS X before 10.12 mishandles scoped-bookmark file descriptors, which allows attackers to cause a denial (no CVSS)
- [CVE-2016-4718](https://cve.now/CVE-2016-4718.md): Buffer overflow in FontParser in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obt (no CVSS)
- [CVE-2016-4722](https://cve.now/CVE-2016-4722.md): The IDS - Connectivity component in Apple iOS before 10 and OS X before 10.12 allows man-in-the-middle attackers to conduct Call Relay spoof (no CVSS)
- [CVE-2016-4723](https://cve.now/CVE-2016-4723.md): Intel Graphics Driver in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of ser (no CVSS)
- [CVE-2016-4724](https://cve.now/CVE-2016-4724.md): IOAcceleratorFamily in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause (no CVSS)
- [CVE-2016-4725](https://cve.now/CVE-2016-4725.md): IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to obtain sensit (no CVSS)
- [CVE-2016-4726](https://cve.now/CVE-2016-4726.md): IOAcceleratorFamily in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary co (no CVSS)
- [CVE-2016-4727](https://cve.now/CVE-2016-4727.md): IOThunderboltFamily in Apple OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial of servi (no CVSS)
- [CVE-2016-4728](https://cve.now/CVE-2016-4728.md): WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 mishandles error prototypes, which allo (no CVSS)
- [CVE-2016-4729](https://cve.now/CVE-2016-4729.md): WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory co (no CVSS)
- [CVE-2016-4730](https://cve.now/CVE-2016-4730.md): WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of s (no CVSS)
- [CVE-2016-4731](https://cve.now/CVE-2016-4731.md): WebKit in Apple iOS before 10 and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory co (no CVSS)
- [CVE-2016-4733](https://cve.now/CVE-2016-4733.md): WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of s (no CVSS)
- [CVE-2016-4734](https://cve.now/CVE-2016-4734.md): WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of s (no CVSS)
- [CVE-2016-4735](https://cve.now/CVE-2016-4735.md): WebKit in Apple iOS before 10, Safari before 10, and tvOS before 10 allows remote attackers to execute arbitrary code or cause a denial of s (no CVSS)
- [CVE-2016-4736](https://cve.now/CVE-2016-4736.md): libarchive in Apple OS X before 10.12 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified (no CVSS)
- [CVE-2016-4737](https://cve.now/CVE-2016-4737.md): WebKit in Apple iOS before 10, Safari before 10, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or c (no CVSS)
- [CVE-2016-4738](https://cve.now/CVE-2016-4738.md): libxslt in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or (no CVSS)
- [CVE-2016-4739](https://cve.now/CVE-2016-4739.md): mDNSResponder in Apple OS X before 10.12, when VMnet.framework is used, arranges for a DNS proxy to listen on all interfaces, which allows r (no CVSS)
- [CVE-2016-4742](https://cve.now/CVE-2016-4742.md): NSSecureTextField in Apple OS X before 10.12 does not enable Secure Input, which allows attackers to discover credentials via a crafted app. (no CVSS)
- [CVE-2016-4745](https://cve.now/CVE-2016-4745.md): The Kerberos 5 (aka krb5) PAM module in Apple OS X before 10.12 does not use constant-time operations for determining username validity, whi (no CVSS)
- [CVE-2016-4748](https://cve.now/CVE-2016-4748.md): Perl in Apple OS X before 10.12 allows local users to bypass the taint-mode protection mechanism via a crafted environment variable. (no CVSS)
- [CVE-2016-4750](https://cve.now/CVE-2016-4750.md): S2 Camera in Apple iOS before 10 and OS X before 10.12 allows attackers to execute arbitrary code in a privileged context or cause a denial (no CVSS)
- [CVE-2016-4751](https://cve.now/CVE-2016-4751.md): The Safari Tabs component in Apple Safari before 10 allows remote attackers to spoof the address bar of a tab via a crafted web site. (no CVSS)
- [CVE-2016-4752](https://cve.now/CVE-2016-4752.md): The SecKeyDeriveFromPassword function in Apple OS X before 10.12 does not use the CF\_RETURNS\_RETAINED keyword, which allows attackers to obt (no CVSS)
- [CVE-2016-4753](https://cve.now/CVE-2016-4753.md): Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 mishandle signed disk images, which allows attackers to execute (no CVSS)
- [CVE-2016-4754](https://cve.now/CVE-2016-4754.md): ServerDocs Server in Apple OS X Server before 5.2 supports the RC4 cipher, which might allow remote attackers to defeat cryptographic protec (no CVSS)
- [CVE-2016-4755](https://cve.now/CVE-2016-4755.md): Terminal in Apple OS X before 10.12 uses weak permissions for the .bash\_history and .bash\_session files, which allows local users to obtain (no CVSS)
- [CVE-2016-4758](https://cve.now/CVE-2016-4758.md): WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly restrict access to the location varia (no CVSS)
- [CVE-2016-4759](https://cve.now/CVE-2016-4759.md): WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-4760](https://cve.now/CVE-2016-4760.md): WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to conduct DNS rebinding attack (no CVSS)
- [CVE-2016-4762](https://cve.now/CVE-2016-4762.md): WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, iCloud before 6.0 on Windows, and Safari before 10 allows remote attackers t (no CVSS)
- [CVE-2016-4763](https://cve.now/CVE-2016-4763.md): WKWebView in WebKit in Apple iOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 does not properly verify X.509 certificate (no CVSS)
- [CVE-2016-4765](https://cve.now/CVE-2016-4765.md): WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-4766](https://cve.now/CVE-2016-4766.md): WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-4767](https://cve.now/CVE-2016-4767.md): WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-4768](https://cve.now/CVE-2016-4768.md): WebKit in Apple iOS before 10, tvOS before 10, iTunes before 12.5.1 on Windows, and Safari before 10 allows remote attackers to execute arbi (no CVSS)
- [CVE-2016-4769](https://cve.now/CVE-2016-4769.md): WebKit in Apple iTunes before 12.5.1 on Windows and Safari before 10 allows remote attackers to execute arbitrary code or cause a denial of (no CVSS)
- [CVE-2016-4771](https://cve.now/CVE-2016-4771.md): The kernel in Apple iOS before 10 and OS X before 10.12 allows local users to bypass intended file-access restrictions via a crafted directo (no CVSS)
- [CVE-2016-4772](https://cve.now/CVE-2016-4772.md): The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to cause a denial of serv (no CVSS)
- [CVE-2016-4773](https://cve.now/CVE-2016-4773.md): The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layou (no CVSS)
- [CVE-2016-4774](https://cve.now/CVE-2016-4774.md): The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layou (no CVSS)
- [CVE-2016-4775](https://cve.now/CVE-2016-4775.md): The kernel in Apple OS X before 10.12, tvOS before 10, and watchOS before 3 allows local users to gain privileges or cause a denial of servi (no CVSS)
- [CVE-2016-4776](https://cve.now/CVE-2016-4776.md): The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to obtain sensitive memory-layou (no CVSS)
- [CVE-2016-4777](https://cve.now/CVE-2016-4777.md): The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a p (no CVSS)
- [CVE-2016-4778](https://cve.now/CVE-2016-4778.md): The kernel in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows attackers to execute arbitrary code in a p (no CVSS)
- [CVE-2016-4779](https://cve.now/CVE-2016-4779.md): Apple Type Services (ATS) in Apple OS X before 10.12 allows remote attackers to execute arbitrary code or cause a denial of service (memory (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-09-25
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.