# CVEs published 2016-12-13

42 CVEs were published on December 13, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2016-2334](https://cve.now/CVE-2016-2334.md): Heap-based buffer overflow in the NArchive::NHfs::CHandler::ExtractZlibFile method in 7zip before 16.00 and p7zip allows remote attackers to (no CVSS)
- [CVE-2016-5060](https://cve.now/CVE-2016-5060.md): Multiple cross-site scripting (XSS) vulnerabilities in nGrinder before 3.4 allow remote attackers to inject arbitrary web script or HTML via (no CVSS)
- [CVE-2016-6663](https://cve.now/CVE-2016-6663.md): Race condition in Oracle MySQL before 5.5.52, 5.6.x before 5.6.33, 5.7.x before 5.7.15, and 8.x before 8.0.1; MariaDB before 5.5.52, 10.0.x (no CVSS)
- [CVE-2016-6664](https://cve.now/CVE-2016-6664.md): mysqld\_safe in Oracle MySQL through 5.5.51, 5.6.x through 5.6.32, and 5.7.x through 5.7.14; MariaDB; Percona Server before 5.5.51-38.2, 5.6. (no CVSS)
- [CVE-2016-4322](https://cve.now/CVE-2016-4322.md): BMC BladeLogic Server Automation (BSA) before 8.7 Patch 3 allows remote attackers to bypass authentication and consequently read arbitrary f (no CVSS)
- [CVE-2016-5407](https://cve.now/CVE-2016-5407.md): The (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXv before 1.0.11 allow remote X servers to trigger out-of-bounds memo (no CVSS)
- [CVE-2016-6313](https://cve.now/CVE-2016-6313.md): The mixing functions in the random number generator in Libgcrypt before 1.5.6, 1.6.x before 1.6.6, and 1.7.x before 1.7.3 and GnuPG before 1 (no CVSS)
- [CVE-2016-7942](https://cve.now/CVE-2016-7942.md): The XGetImage function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving image type and geo (no CVSS)
- [CVE-2016-7943](https://cve.now/CVE-2016-7943.md): The XListFonts function in X.org libX11 before 1.6.4 might allow remote X servers to gain privileges via vectors involving length fields, wh (no CVSS)
- [CVE-2016-7944](https://cve.now/CVE-2016-7944.md): Integer overflow in X.org libXfixes before 5.0.3 on 32-bit platforms might allow remote X servers to gain privileges via a length value of I (no CVSS)
- [CVE-2016-7945](https://cve.now/CVE-2016-7945.md): Multiple integer overflows in X.org libXi before 1.7.7 allow remote X servers to cause a denial of service (out-of-bounds memory access or i (no CVSS)
- [CVE-2016-7946](https://cve.now/CVE-2016-7946.md): X.org libXi before 1.7.7 allows remote X servers to cause a denial of service (infinite loop) via vectors involving length fields. (no CVSS)
- [CVE-2016-7947](https://cve.now/CVE-2016-7947.md): Multiple integer overflows in X.org libXrandr before 1.5.1 allow remote X servers to trigger out-of-bounds write operations via a crafted re (no CVSS)
- [CVE-2016-7948](https://cve.now/CVE-2016-7948.md): X.org libXrandr before 1.5.1 allows remote X servers to trigger out-of-bounds write operations by leveraging mishandling of reply data. (no CVSS)
- [CVE-2016-7949](https://cve.now/CVE-2016-7949.md): Multiple buffer overflows in the (1) XvQueryAdaptors and (2) XvQueryEncodings functions in X.org libXrender before 0.9.10 allow remote X ser (no CVSS)
- [CVE-2016-7950](https://cve.now/CVE-2016-7950.md): The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vec (no CVSS)
- [CVE-2016-7951](https://cve.now/CVE-2016-7951.md): Multiple integer overflows in X.org libXtst before 1.2.3 allow remote X servers to trigger out-of-bounds memory access operations by leverag (no CVSS)
- [CVE-2016-7952](https://cve.now/CVE-2016-7952.md): X.org libXtst before 1.2.3 allows remote X servers to cause a denial of service (infinite loop) via a reply in the (1) XRecordStartOfData, ( (no CVSS)
- [CVE-2016-7953](https://cve.now/CVE-2016-7953.md): Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string. (no CVSS)
- [CVE-2016-6699](https://cve.now/CVE-2016-6699.md): A remote code execution vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable an attacker using a spe (no CVSS)
- [CVE-2016-6706](https://cve.now/CVE-2016-6706.md): An elevation of privilege vulnerability in libstagefright in Mediaserver in Android 7.0 before 2016-11-01 could enable a local malicious app (no CVSS)
- [CVE-2016-6711](https://cve.now/CVE-2016-6711.md): A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6 (no CVSS)
- [CVE-2016-6712](https://cve.now/CVE-2016-6712.md): A remote denial of service vulnerability in libvpx in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6 (no CVSS)
- [CVE-2016-6720](https://cve.now/CVE-2016-6720.md): An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1 (no CVSS)
- [CVE-2016-6722](https://cve.now/CVE-2016-6722.md): An information disclosure vulnerability in libstagefright in Mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1 (no CVSS)
- [CVE-2016-5647](https://cve.now/CVE-2016-5647.md): The igdkmd64 module in the Intel Graphics Driver through 15.33.42.435, 15.36.x through 15.36.30.4385, and 15.40.x through 15.40.4404 on Wind (no CVSS)
- [CVE-2015-3210](https://cve.now/CVE-2015-3210.md): Heap-based buffer overflow in PCRE 8.34 through 8.37 and PCRE2 10.10 allows remote attackers to execute arbitrary code via a crafted regular (no CVSS)
- [CVE-2015-3217](https://cve.now/CVE-2015-3217.md): PCRE 7.8 and 8.32 through 8.37, and PCRE2 10.10 mishandle group empty matches, which might allow remote attackers to cause a denial of servi (no CVSS)
- [CVE-2015-3418](https://cve.now/CVE-2015-3418.md): The ProcPutImage function in dix/dispatch.c in X.Org Server (aka xserver and xorg-server) before 1.16.4 allows attackers to cause a denial o (no CVSS)
- [CVE-2015-5073](https://cve.now/CVE-2015-5073.md): Heap-based buffer overflow in the find\_fixedlength function in pcre\_compile.c in PCRE before 8.38 allows remote attackers to cause a denial (no CVSS)
- [CVE-2016-7438](https://cve.now/CVE-2016-7438.md): The C software implementation of ECC in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leve (no CVSS)
- [CVE-2016-7439](https://cve.now/CVE-2016-7439.md): The C software implementation of RSA in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to discover RSA keys by leve (no CVSS)
- [CVE-2016-7440](https://cve.now/CVE-2016-7440.md): The C software implementation of AES Encryption and Decryption in wolfSSL (formerly CyaSSL) before 3.9.10 makes it easier for local users to (no CVSS)
- [CVE-2016-5687](https://cve.now/CVE-2016-5687.md): The VerticalFilter function in the DDS coder in ImageMagick before 6.9.4-3 and 7.x before 7.0.1-4 allows remote attackers to have unspecifie (no CVSS)
- [CVE-2016-5688](https://cve.now/CVE-2016-5688.md): The WPG parser in ImageMagick before 6.9.4-4 and 7.x before 7.0.1-5, when a memory limit is set, allows remote attackers to have unspecified (no CVSS)
- [CVE-2016-5689](https://cve.now/CVE-2016-5689.md): The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of (no CVSS)
- [CVE-2016-5690](https://cve.now/CVE-2016-5690.md): The ReadDCMImage function in DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified imp (no CVSS)
- [CVE-2016-5691](https://cve.now/CVE-2016-5691.md): The DCM reader in ImageMagick before 6.9.4-5 and 7.x before 7.0.1-7 allows remote attackers to have unspecified impact by leveraging lack of (no CVSS)
- [CVE-2016-5841](https://cve.now/CVE-2016-5841.md): Integer overflow in MagickCore/profile.c in ImageMagick before 7.0.2-1 allows remote attackers to cause a denial of service (segmentation fa (no CVSS)
- [CVE-2016-5842](https://cve.now/CVE-2016-5842.md): MagickCore/property.c in ImageMagick before 7.0.2-1 allows remote attackers to obtain sensitive memory information via vectors involving the (no CVSS)
- [CVE-2016-6491](https://cve.now/CVE-2016-6491.md): Buffer overflow in the Get8BIMProperty function in MagickCore/property.c in ImageMagick before 6.9.5-4 and 7.x before 7.0.2-6 allows remote (no CVSS)
- [CVE-2016-6520](https://cve.now/CVE-2016-6520.md): Buffer overflow in MagickCore/enhance.c in ImageMagick before 7.0.2-7 allows remote attackers to have unspecified impact via vectors related (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-12-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.