# CVEs published 2016-10-03

45 CVEs were published on October 3, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2013-4118](https://cve.now/CVE-2013-4118.md): FreeRDP before 1.1.0-beta1 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via unspeci (no CVSS)
- [CVE-2013-4119](https://cve.now/CVE-2013-4119.md): FreeRDP before 1.1.0-beta+2013071101 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) b (no CVSS)
- [CVE-2015-1832](https://cve.now/CVE-2015-1832.md): XML external entity (XXE) vulnerability in the SqlXmlUtil code in Apache Derby before 10.12.1.1, when a Java Security Manager is not in plac (no CVSS, org.apache.derby:derby)
- [CVE-2015-8085](https://cve.now/CVE-2015-8085.md): Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with softwa (no CVSS)
- [CVE-2015-8086](https://cve.now/CVE-2015-8086.md): Huawei AR routers with software before V200R007C00SPC100; Quidway S9300 routers with software before V200R009C00; S12700 routers with softwa (no CVSS)
- [CVE-2016-6905](https://cve.now/CVE-2016-6905.md): The read\_image\_tga function in gd\_tga.c in the GD Graphics Library (aka libgd) before 2.2.3 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2016-7046](https://cve.now/CVE-2016-7046.md): Red Hat JBoss Enterprise Application Platform (EAP) 7, when operating as a reverse-proxy with default buffer sizes, allows remote attackers (no CVSS, io.undertow:undertow-core)
- [CVE-2016-7141](https://cve.now/CVE-2016-7141.md): curl and libcurl before 7.50.2, when built with NSS and the libnsspem.so library is available at runtime, allow remote attackers to hijack t (no CVSS)
- [CVE-2016-8276](https://cve.now/CVE-2016-8276.md): Buffer overflow in the Point-to-Point Protocol over Ethernet (PPPoE) module in Huawei USG2100, USG2200, USG5100, and USG5500 unified securit (no CVSS)
- [CVE-2016-8277](https://cve.now/CVE-2016-8277.md): Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote authenticated users to ca (no CVSS)
- [CVE-2016-8278](https://cve.now/CVE-2016-8278.md): Huawei USG9520, USG9560, and USG9580 unified security gateways with software before V300R001C01SPCa00 allow remote attackers to cause a deni (no CVSS)
- [CVE-2016-8280](https://cve.now/CVE-2016-8280.md): Directory traversal vulnerability in Huawei eSight before V300R003C20SPC005 allows remote authenticated users to read arbitrary files via un (no CVSS)
- [CVE-2016-1371](https://cve.now/CVE-2016-1371.md): ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted mew packer (no CVSS)
- [CVE-2016-1372](https://cve.now/CVE-2016-1372.md): ClamAV (aka Clam AntiVirus) before 0.99.2 allows remote attackers to cause a denial of service (application crash) via a crafted 7z file. (no CVSS)
- [CVE-2016-5019](https://cve.now/CVE-2016-5019.md): CoreResponseStateManager in Apache MyFaces Trinidad 1.0.0 through 1.0.13, 1.2.x before 1.2.15, 2.0.x before 2.0.2, and 2.1.x before 2.1.2 mi (no CVSS, org.apache.myfaces.trinidad:trinidad)
- [CVE-2016-5398](https://cve.now/CVE-2016-5398.md): Cross-site scripting (XSS) vulnerability in Business Process Editor in Red Hat JBoss BPM Suite before 6.3.3 allows remote authenticated user (no CVSS)
- [CVE-2016-5432](https://cve.now/CVE-2016-5432.md): The ovirt-engine-provisiondb utility in Red Hat Enterprise Virtualization (RHEV) Engine 4.0 allows local users to obtain sensitive database (no CVSS)
- [CVE-2016-6352](https://cve.now/CVE-2016-6352.md): The OneLine32 function in io-ico.c in gdk-pixbuf before 2.35.3 allows remote attackers to cause a denial of service (out-of-bounds write and (no CVSS)
- [CVE-2016-6494](https://cve.now/CVE-2016-6494.md): The client in MongoDB uses world-readable permissions on .dbshell history files, which might allow local users to obtain sensitive informati (no CVSS)
- [CVE-2016-7031](https://cve.now/CVE-2016-7031.md): The RGW code in Ceph before 10.0.1, when authenticated-read ACL is applied to a bucket, allows remote attackers to list the bucket contents (no CVSS)
- [CVE-2016-7401](https://cve.now/CVE-2016-7401.md): The cookie parsing code in Django before 1.8.15 and 1.9.x before 1.9.10, when used on a site with Google Analytics, allows remote attackers (no CVSS, django)
- [CVE-2016-7405](https://cve.now/CVE-2016-7405.md): The qstr method in the PDO driver in the ADOdb Library for PHP before 5.x before 5.20.7 might allow remote attackers to conduct SQL injectio (no CVSS, adodb/adodb-php)
- [CVE-2016-7570](https://cve.now/CVE-2016-7570.md): Drupal 8.x before 8.1.10 does not properly check for "Administer comments" permission, which allows remote authenticated users to set the vi (no CVSS, drupal/drupal · drupal/core)
- [CVE-2016-7571](https://cve.now/CVE-2016-7571.md): Cross-site scripting (XSS) vulnerability in Drupal 8.x before 8.1.10 allows remote attackers to inject arbitrary web script or HTML via vect (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-7572](https://cve.now/CVE-2016-7572.md): The system.temporary route in Drupal 8.x before 8.1.10 does not properly check for "Export configuration" permission, which allows remote au (no CVSS, drupal/core · drupal/drupal)
- [CVE-2016-3619](https://cve.now/CVE-2016-3619.md): The DumpModeEncode function in tif\_dumpmode.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c none" option is used, allows r (no CVSS)
- [CVE-2016-3620](https://cve.now/CVE-2016-3620.md): The ZIPEncode function in tif\_zip.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c zip" option is used, allows remote attac (no CVSS)
- [CVE-2016-3621](https://cve.now/CVE-2016-3621.md): The LZWEncode function in tif\_lzw.c in the bmp2tiff tool in LibTIFF 4.0.6 and earlier, when the "-c lzw" option is used, allows remote attac (no CVSS)
- [CVE-2016-3622](https://cve.now/CVE-2016-3622.md): The fpAcc function in tif\_predict.c in the tiff2rgba tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2016-3623](https://cve.now/CVE-2016-3623.md): The rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (divide-by-zero) by setting the (1) v o (no CVSS)
- [CVE-2016-3624](https://cve.now/CVE-2016-3624.md): The cvtClump function in the rgb2ycbcr tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds (no CVSS)
- [CVE-2016-3625](https://cve.now/CVE-2016-3625.md): tif\_read.c in the tiff2bw tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds read) via a (no CVSS)
- [CVE-2016-3631](https://cve.now/CVE-2016-3631.md): The (1) cpStrips and (2) cpTiles functions in the thumbnail tool in LibTIFF 4.0.6 and earlier allow remote attackers to cause a denial of se (no CVSS)
- [CVE-2016-3633](https://cve.now/CVE-2016-3633.md): The setrow function in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of service (out-of-bounds r (no CVSS)
- [CVE-2016-3634](https://cve.now/CVE-2016-3634.md): The tagCompare function in tif\_dirinfo.c in the thumbnail tool in LibTIFF 4.0.6 and earlier allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2016-3658](https://cve.now/CVE-2016-3658.md): The TIFFWriteDirectoryTagLongLong8Array function in tif\_dirwrite.c in the tiffset tool in LibTIFF 4.0.6 and earlier allows remote attackers (no CVSS)
- [CVE-2016-5700](https://cve.now/CVE-2016-5700.md): Virtual servers in F5 BIG-IP systems 11.5.0, 11.5.1 before HF11, 11.5.2, 11.5.3, 11.5.4 before HF2, 11.6.0 before HF8, 11.6.1 before HF1, 12 (no CVSS)
- [CVE-2016-7397](https://cve.now/CVE-2016-7397.md): The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information (no CVSS)
- [CVE-2016-7442](https://cve.now/CVE-2016-7442.md): The Frontend component in Sophos UTM with firmware 9.405-5 and earlier allows local administrators to obtain sensitive password information (no CVSS)
- [CVE-2016-7445](https://cve.now/CVE-2016-7445.md): convert.c in OpenJPEG before 2.1.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via (no CVSS)
- [CVE-2016-4436](https://cve.now/CVE-2016-4436.md): Apache Struts 2 before 2.3.29 and 2.5.x before 2.5.1 allow attackers to have unspecified impact via vectors related to improper action name (no CVSS, org.apache.struts:struts2-core)
- [CVE-2016-5180](https://cve.now/CVE-2016-5180.md): Heap-based buffer overflow in the ares\_create\_query function in c-ares 1.x before 1.12.0 allows remote attackers to cause a denial of servic (no CVSS)
- [CVE-2016-1240](https://cve.now/CVE-2016-1240.md): The Tomcat init script in the tomcat7 package before 7.0.56-3+deb8u4 and tomcat8 package before 8.0.14-1+deb8u3 on Debian jessie and the tom (no CVSS)
- [CVE-2016-1243](https://cve.now/CVE-2016-1243.md): Stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute arbitrary code via a long pathname. (no CVSS)
- [CVE-2016-1244](https://cve.now/CVE-2016-1244.md): The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf f (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-10-03
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.