# CVEs published 2016-10-07

13 CVEs were published on October 7, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-1000001](https://cve.now/CVE-2016-1000001.md): flask-oidc version 0.1.2 and earlier is vulnerable to an open redirect (no CVSS, flask-oidc)
- [CVE-2016-1000003](https://cve.now/CVE-2016-1000003.md): Mirror Manager version 0.7.2 and older is vulnerable to remote code execution in the checkin code. (no CVSS)
- [CVE-2016-1000007](https://cve.now/CVE-2016-1000007.md): Pagure 2.2.1 XSS in raw file endpoint (no CVSS)
- [CVE-2015-2080](https://cve.now/CVE-2015-2080.md): The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process mem (no CVSS, org.eclipse.jetty:jetty-server)
- [CVE-2015-5162](https://cve.now/CVE-2015-5162.md): The image parser in OpenStack Cinder 7.0.2 and 8.0.0 through 8.1.1; Glance before 11.0.1 and 12.0.0; and Nova before 12.0.4 and 13.0.0 does (no CVSS, nova · cinder +1)
- [CVE-2015-7363](https://cve.now/CVE-2015-7363.md): Cross-site scripting (XSS) vulnerability in the advanced settings page in Fortinet FortiManager 5.x before 5.0.12 and 5.2.x before 5.2.3, in (no CVSS)
- [CVE-2016-3699](https://cve.now/CVE-2016-3699.md): The Linux kernel, as used in Red Hat Enterprise Linux 7.2 and Red Hat Enterprise MRG 2 and when booted with UEFI Secure Boot enabled, allows (no CVSS)
- [CVE-2016-6273](https://cve.now/CVE-2016-6273.md): The lmadmin component in Flexera FlexNet Publisher (aka Flex License Manager) before 2015 SP5 and 2016 before R1 SP1, as used by Citrix Lice (no CVSS)
- [CVE-2016-6323](https://cve.now/CVE-2016-6323.md): The makecontext function in the GNU C Library (aka glibc or libc6) before 2.25 creates execution contexts incompatible with the unwinder on (no CVSS)
- [CVE-2016-7040](https://cve.now/CVE-2016-7040.md): Red Hat CloudForms Management Engine 4.1 does not properly handle regular expressions passed to the expression engine via the JSON API and t (no CVSS)
- [CVE-2016-7167](https://cve.now/CVE-2016-7167.md): Multiple integer overflows in the (1) curl\_escape, (2) curl\_easy\_escape, (3) curl\_unescape, and (4) curl\_easy\_unescape functions in libcurl (no CVSS)
- [CVE-2016-7424](https://cve.now/CVE-2016-7424.md): The put\_no\_rnd\_pixels8\_xy2\_mmx function in x86/rnd\_template.c in libav 11.7 and earlier allows remote attackers to cause a denial of service (no CVSS)
- [CVE-2016-7777](https://cve.now/CVE-2016-7777.md): Xen 4.7.x and earlier does not properly honor CR0.TS and CR0.EM, which allows local x86 HVM guest OS users to read or modify FPU, MMX, or XM (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-10-07
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.