# CVEs published 2016-12-29

43 CVEs were published on December 29, 2016: 0 critical, 0 high. Days are UTC.

- [CVE-2015-8701](https://cve.now/CVE-2015-8701.md): QEMU (aka Quick Emulator) built with the Rocker switch emulation support is vulnerable to an off-by-one error. (no CVSS)
- [CVE-2015-8743](https://cve.now/CVE-2015-8743.md): QEMU (aka Quick Emulator) built with the NE2000 device emulation support is vulnerable to an OOB r/w access issue. (no CVSS)
- [CVE-2015-8744](https://cve.now/CVE-2015-8744.md): QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. (no CVSS)
- [CVE-2015-8745](https://cve.now/CVE-2015-8745.md): QEMU (aka Quick Emulator) built with a VMWARE VMXNET3 paravirtual NIC emulator support is vulnerable to crash issue. (no CVSS)
- [CVE-2015-8817](https://cve.now/CVE-2015-8817.md): QEMU (aka Quick Emulator) built to use 'address\_space\_translate' to map an address to a MemoryRegionSection is vulnerable to an OOB r/w acce (no CVSS)
- [CVE-2015-8818](https://cve.now/CVE-2015-8818.md): The cpu\_physical\_memory\_write\_rom\_internal function in exec.c in QEMU (aka Quick Emulator) does not properly skip MMIO regions, which allows (no CVSS)
- [CVE-2016-1922](https://cve.now/CVE-2016-1922.md): QEMU (aka Quick Emulator) built with the TPR optimization for 32-bit Windows guests support is vulnerable to a null pointer dereference flaw (no CVSS)
- [CVE-2016-1981](https://cve.now/CVE-2016-1981.md): QEMU (aka Quick Emulator) built with the e1000 NIC emulation support is vulnerable to an infinite loop issue. (no CVSS)
- [CVE-2016-2197](https://cve.now/CVE-2016-2197.md): QEMU (aka Quick Emulator) built with an IDE AHCI emulation support is vulnerable to a null pointer dereference flaw. (no CVSS)
- [CVE-2016-2198](https://cve.now/CVE-2016-2198.md): QEMU (aka Quick Emulator) built with the USB EHCI emulation support is vulnerable to a null pointer dereference flaw. (no CVSS)
- [CVE-2016-9776](https://cve.now/CVE-2016-9776.md): QEMU (aka Quick Emulator) built with the ColdFire Fast Ethernet Controller emulator support is vulnerable to an infinite loop issue. (no CVSS)
- [CVE-2016-9845](https://cve.now/CVE-2016-9845.md): QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to an information leakage issue. (no CVSS)
- [CVE-2016-9846](https://cve.now/CVE-2016-9846.md): QEMU (aka Quick Emulator) built with the Virtio GPU Device emulator support is vulnerable to a memory leakage issue. (no CVSS)
- [CVE-2016-9913](https://cve.now/CVE-2016-9913.md): Memory leak in the v9fs\_device\_unrealize\_common function in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users (no CVSS)
- [CVE-2016-9914](https://cve.now/CVE-2016-9914.md): Memory leak in hw/9pfs/9p.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host memory co (no CVSS)
- [CVE-2016-9915](https://cve.now/CVE-2016-9915.md): Memory leak in hw/9pfs/9p-handle.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host me (no CVSS)
- [CVE-2016-9916](https://cve.now/CVE-2016-9916.md): Memory leak in hw/9pfs/9p-proxy.c in QEMU (aka Quick Emulator) allows local privileged guest OS users to cause a denial of service (host mem (no CVSS)
- [CVE-2015-0854](https://cve.now/CVE-2015-0854.md): App/HelperFunctions.pm in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image nam (no CVSS)
- [CVE-2016-10081](https://cve.now/CVE-2016-10081.md): /usr/bin/shutter in Shutter through 0.93.1 allows user-assisted remote attackers to execute arbitrary commands via a crafted image name that (no CVSS)
- [CVE-2016-9891](https://cve.now/CVE-2016-9891.md): Cross-site scripting (XSS) vulnerability in admin/media.php and admin/media\_item.php in Dotclear before 2.11 allows remote authenticated use (no CVSS)
- [CVE-2016-2246](https://cve.now/CVE-2016-2246.md): HP ThinPro 4.4 through 6.1 mishandles the keyboard layout control panel and virtual keyboard application, which allows local users to bypass (no CVSS)
- [CVE-2016-5328](https://cve.now/CVE-2016-5328.md): VMware Tools 9.x and 10.x before 10.1.0 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel m (no CVSS)
- [CVE-2016-5329](https://cve.now/CVE-2016-5329.md): VMware Fusion 8.x before 8.5 on OS X, when System Integrity Protection (SIP) is enabled, allows local users to determine kernel memory addre (no CVSS)
- [CVE-2016-5334](https://cve.now/CVE-2016-5334.md): VMware Identity Manager 2.x before 2.7.1 and vRealize Automation 7.x before 7.2.0 allow remote attackers to read /SAAS/WEB-INF and /SAAS/MET (no CVSS)
- [CVE-2016-7079](https://cve.now/CVE-2016-7079.md): The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial (no CVSS)
- [CVE-2016-7080](https://cve.now/CVE-2016-7080.md): The graphic acceleration functions in VMware Tools 9.x and 10.x before 10.0.9 on OS X allow local users to gain privileges or cause a denial (no CVSS)
- [CVE-2016-7081](https://cve.now/CVE-2016-7081.md): Multiple heap-based buffer overflows in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Window (no CVSS)
- [CVE-2016-7082](https://cve.now/CVE-2016-7082.md): VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printi (no CVSS)
- [CVE-2016-7083](https://cve.now/CVE-2016-7083.md): VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint virtual printi (no CVSS)
- [CVE-2016-7084](https://cve.now/CVE-2016-7084.md): tpview.dll in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows, when Cortado ThinPrint (no CVSS)
- [CVE-2016-7085](https://cve.now/CVE-2016-7085.md): Untrusted search path vulnerability in the installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before (no CVSS)
- [CVE-2016-7086](https://cve.now/CVE-2016-7086.md): The installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to (no CVSS)
- [CVE-2016-7087](https://cve.now/CVE-2016-7087.md): Directory traversal vulnerability in the Connection Server in VMware Horizon View 5.x before 5.3.7, 6.x before 6.2.3, and 7.x before 7.0.1 a (no CVSS)
- [CVE-2016-7456](https://cve.now/CVE-2016-7456.md): VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for rem (no CVSS)
- [CVE-2016-7457](https://cve.now/CVE-2016-7457.md): VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to gain privileges, or halt and remove virtual mac (no CVSS)
- [CVE-2016-7458](https://cve.now/CVE-2016-7458.md): VMware vSphere Client 5.5 before U3e and 6.0 before U2a allows remote vCenter Server and ESXi instances to read arbitrary files via an XML d (no CVSS)
- [CVE-2016-7459](https://cve.now/CVE-2016-7459.md): VMware vCenter Server 5.5 before U3e and 6.0 before U2a allows remote authenticated users to read arbitrary files via a (1) Log Browser, (2) (no CVSS)
- [CVE-2016-7460](https://cve.now/CVE-2016-7460.md): The Single Sign-On feature in VMware vCenter Server 5.5 before U3e and 6.0 before U2a and vRealize Automation 6.x before 6.2.5 allows remote (no CVSS)
- [CVE-2016-7461](https://cve.now/CVE-2016-7461.md): The drag-and-drop (aka DnD) function in VMware Workstation Pro 12.x before 12.5.2 and VMware Workstation Player 12.x before 12.5.2 and VMwar (no CVSS)
- [CVE-2016-7462](https://cve.now/CVE-2016-7462.md): The Suite REST API in VMware vRealize Operations (aka vROps) 6.x before 6.4.0 allows remote authenticated users to write arbitrary content t (no CVSS)
- [CVE-2016-7463](https://cve.now/CVE-2016-7463.md): Cross-site scripting (XSS) vulnerability in the Host Client in VMware vSphere Hypervisor (aka ESXi) 5.5 and 6.0 allows remote authenticated (no CVSS)
- [CVE-2016-9877](https://cve.now/CVE-2016-9877.md): An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6 and RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1 (no CVSS, Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6; R…)
- [CVE-2016-9878](https://cve.now/CVE-2016-9878.md): An issue was discovered in Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9, and 4.3.x before 4.3.5. (no CVSS, Pivotal Spring Framework before 3.2.18, 4.2.x before 4.2.9,…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2016-12-29
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.