# CVEs published 2016-12-23 29 CVEs were published on December 23, 2016: 0 critical, 3 high. Days are UTC. - [CVE-2016-2312](https://cve.now/CVE-2016-2312.md): Turning all screens off in Plasma-workspace and kscreenlocker while the lock screen is shown can result in the screen being unlocked when tu (no CVSS) - [CVE-2016-7787](https://cve.now/CVE-2016-7787.md): A maliciously crafted command line for kdesu can result in the user only seeing part of the commands that will actually get executed as supe (no CVSS) - [CVE-2016-7966](https://cve.now/CVE-2016-7966.md): Through a malicious URL that contained a quote character it was possible to inject HTML code in KMail's plaintext viewer. (no CVSS) - [CVE-2016-7967](https://cve.now/CVE-2016-7967.md): KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. (no CVSS) - [CVE-2016-7968](https://cve.now/CVE-2016-7968.md): KMail since version 5.3.0 used a QWebEngine based viewer that had JavaScript enabled. (no CVSS) - [CVE-2016-8707](https://cve.now/CVE-2016-8707.md): An exploitable out of bounds write exists in the handling of compressed TIFF images in ImageMagicks's convert utility. (CVSS 7.5, ImageMagick 7.0.3-1) - [CVE-2016-9036](https://cve.now/CVE-2016-9036.md): An exploitable incorrect return value vulnerability exists in the mp\_check function of Tarantool's Msgpuck library 1.0.3. (CVSS 7.5, Tarantool Msgpuck library) - [CVE-2016-9037](https://cve.now/CVE-2016-9037.md): An exploitable out-of-bounds array access vulnerability exists in the xrow\_header\_decode function of Tarantool 1.7.2.0-g8e92715. (CVSS 7.5, Tarantool) - [CVE-2016-9907](https://cve.now/CVE-2016-9907.md): Quick Emulator (Qemu) built with the USB redirector usb-guest support is vulnerable to a memory leakage flaw. (no CVSS) - [CVE-2016-9908](https://cve.now/CVE-2016-9908.md): Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. (no CVSS) - [CVE-2016-9911](https://cve.now/CVE-2016-9911.md): Quick Emulator (Qemu) built with the USB EHCI Emulation support is vulnerable to a memory leakage issue. (no CVSS) - [CVE-2016-9912](https://cve.now/CVE-2016-9912.md): Quick Emulator (Qemu) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. (no CVSS) - [CVE-2016-9921](https://cve.now/CVE-2016-9921.md): Quick emulator (Qemu) built with the Cirrus CLGD 54xx VGA Emulator support is vulnerable to a divide by zero issue. (no CVSS) - [CVE-2016-9923](https://cve.now/CVE-2016-9923.md): Quick Emulator (Qemu) built with the 'chardev' backend support is vulnerable to a use after free issue. (no CVSS) - [CVE-2016-6910](https://cve.now/CVE-2016-6910.md): The non-existent notification listener vulnerability was introduced in the initial Android 5.0.2 builds for the Samsung Galaxy S6 Edge devic (no CVSS) - [CVE-2016-6659](https://cve.now/CVE-2016-6659.md): Cloud Foundry before 248; UAA 2.x before 2.7.4.12, 3.x before 3.6.5, and 3.7.x through 3.9.x before 3.9.3; and UAA bosh release (aka uaa-rel (no CVSS, Cloud Foundry v247 and earlier and UAA v3.9.2 & earlier and…) - [CVE-2016-6671](https://cve.now/CVE-2016-6671.md): The raw\_decode function in libavcodec/rawdec.c in FFmpeg before 3.1.2 allows remote attackers to cause a denial of service (memory corruptio (no CVSS) - [CVE-2016-6881](https://cve.now/CVE-2016-6881.md): The zlib\_refill function in libavformat/swfdec.c in FFmpeg before 3.1.3 allows remote attackers to cause an infinite loop denial of service (no CVSS) - [CVE-2016-7122](https://cve.now/CVE-2016-7122.md): The avi\_read\_nikon function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to infinite loop when it decodes an AVI file that h (no CVSS) - [CVE-2016-7450](https://cve.now/CVE-2016-7450.md): The ff\_log2\_16bit\_c function in libavutil/intmath.h in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when it decodes a m (no CVSS) - [CVE-2016-7502](https://cve.now/CVE-2016-7502.md): The cavs\_idct8\_add\_c function in libavcodec/cavsdsp.c in FFmpeg before 3.1.4 is vulnerable to reading out-of-bounds memory when decoding wit (no CVSS) - [CVE-2016-7555](https://cve.now/CVE-2016-7555.md): The avi\_read\_header function in libavformat/avidec.c in FFmpeg before 3.1.4 is vulnerable to memory leak when decoding an AVI file that has (no CVSS) - [CVE-2016-7562](https://cve.now/CVE-2016-7562.md): The ff\_draw\_pc\_font function in libavcodec/cga\_data.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (buffer ov (no CVSS) - [CVE-2016-7785](https://cve.now/CVE-2016-7785.md): The avi\_read\_seek function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (assert fault (no CVSS) - [CVE-2016-7905](https://cve.now/CVE-2016-7905.md): The read\_gab2\_sub function in libavformat/avidec.c in FFmpeg before 3.1.4 allows remote attackers to cause a denial of service (NULL pointer (no CVSS) - [CVE-2016-8595](https://cve.now/CVE-2016-8595.md): The gsm\_parse function in libavcodec/gsm\_parser.c in FFmpeg before 3.1.5 allows remote attackers to cause a denial of service (assert fault) (no CVSS) - [CVE-2016-9154](https://cve.now/CVE-2016-9154.md): Siemens Desigo PX Web modules PXA40-W0, PXA40-W1, PXA40-W2 for Desigo PX automation controllers PXC00-E.D, PXC50-E.D, PXC100-E.D, PXC200-E.D (no CVSS, Desigo PX Web modules with all firmware versions \<) - [CVE-2016-9561](https://cve.now/CVE-2016-9561.md): The che\_configure function in libavcodec/aacdec\_template.c in FFmpeg before 3.2.1 allows remote attackers to cause a denial of service (allo (no CVSS) - [CVE-2016-9889](https://cve.now/CVE-2016-9889.md): Some forms with the parameter geo\_zoomlevel\_to\_found\_location in Tiki Wiki CMS 12.x before 12.10 LTS, 15.x before 15.3 LTS, and 16.x before (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2016-12-23 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.