# CVEs published 2016-12-09 19 CVEs were published on December 9, 2016: 0 critical, 3 high. Days are UTC. - [CVE-2016-5423](https://cve.now/CVE-2016-5423.md): PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated us (no CVSS) - [CVE-2016-5424](https://cve.now/CVE-2016-5424.md): PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authentica (no CVSS) - [CVE-2016-6321](https://cve.now/CVE-2016-6321.md): Directory traversal vulnerability in the safer\_name\_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an i (CVSS 7.5) - [CVE-2016-6496](https://cve.now/CVE-2016-6496.md): The LDAP directory connector in Atlassian Crowd before 2.8.8 and 2.9.x before 2.9.5 allows remote attackers to execute arbitrary code via an (no CVSS) - [CVE-2016-6501](https://cve.now/CVE-2016-6501.md): JFrog Artifactory before 4.11 allows remote attackers to execute arbitrary code via an LDAP attribute with a crafted serialized Java object, (no CVSS) - [CVE-2016-9101](https://cve.now/CVE-2016-9101.md): Memory leak in hw/net/eepro100.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of service (memory cons (no CVSS) - [CVE-2016-9102](https://cve.now/CVE-2016-9102.md): Memory leak in the v9fs\_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a de (no CVSS) - [CVE-2016-9103](https://cve.now/CVE-2016-9103.md): The v9fs\_xattrcreate function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to obtain sensitive host hea (no CVSS) - [CVE-2016-9104](https://cve.now/CVE-2016-9104.md): Multiple integer overflows in the (1) v9fs\_xattr\_read and (2) v9fs\_xattr\_write functions in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allow (no CVSS) - [CVE-2016-9105](https://cve.now/CVE-2016-9105.md): Memory leak in the v9fs\_link function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial of (no CVSS) - [CVE-2016-9106](https://cve.now/CVE-2016-9106.md): Memory leak in the v9fs\_write function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local guest OS administrators to cause a denial o (no CVSS) - [CVE-2015-8786](https://cve.now/CVE-2015-8786.md): The Management plugin in RabbitMQ before 3.6.1 allows remote authenticated users with certain privileges to cause a denial of service (resou (no CVSS) - [CVE-2016-6301](https://cve.now/CVE-2016-6301.md): The recv\_and\_process\_client\_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandw (CVSS 7.5) - [CVE-2016-6523](https://cve.now/CVE-2016-6523.md): Multiple cross-site scripting (XSS) vulnerabilities in the media manager in Dotclear before 2.10 allow remote attackers to inject arbitrary (no CVSS) - [CVE-2016-6829](https://cve.now/CVE-2016-6829.md): The trove service user in (1) Openstack deployment (aka crowbar-openstack) and (2) Trove Barclamp (aka barclamp-trove and crowbar-barclamp-t (no CVSS) - [CVE-2016-9013](https://cve.now/CVE-2016-9013.md): Django 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3 use a hardcoded password for a temporary database user created whe (no CVSS, django) - [CVE-2016-9014](https://cve.now/CVE-2016-9014.md): Django before 1.8.x before 1.8.16, 1.9.x before 1.9.11, and 1.10.x before 1.10.3, when settings.DEBUG is True, allow remote attackers to con (no CVSS, django) - [CVE-2016-9832](https://cve.now/CVE-2016-9832.md): PricewaterhouseCoopers (PwC) ACE-ABAP 8.10.304 for SAP Security allows remote authenticated users to conduct ABAP injection attacks and exec (no CVSS) - [CVE-2016-8858](https://cve.now/CVE-2016-8858.md): The kex\_input\_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory cons (CVSS 7.5) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-12-09 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.