# CVEs published 2017-01-04

19 CVEs were published on January 4, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-6894](https://cve.now/CVE-2016-6894.md): Arista EOS 4.15 before 4.15.8M, 4.16 before 4.16.7M, and 4.17 before 4.17.0F on DCS-7050 series devices allow remote attackers to cause a de (no CVSS)
- [CVE-2016-7399](https://cve.now/CVE-2016-7399.md): scripts/license.pl in Veritas NetBackup Appliance 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x allow rem (no CVSS)
- [CVE-2016-7902](https://cve.now/CVE-2016-7902.md): Unrestricted file upload vulnerability in the fileUnzip-\>unzip method in Dotclear before 2.10.3 allows remote authenticated users with permi (no CVSS)
- [CVE-2016-7903](https://cve.now/CVE-2016-7903.md): Dotclear before 2.10.3, when the Host header is not part of the web server routing process, allows remote attackers to modify the password r (no CVSS)
- [CVE-2014-9911](https://cve.now/CVE-2014-9911.md): Stack-based buffer overflow in the ures\_getByKeyWithFallback function in common/uresbund.cpp in International Components for Unicode (ICU) b (no CVSS)
- [CVE-2014-9912](https://cve.now/CVE-2014-9912.md): The get\_icu\_disp\_value\_src\_php function in ext/intl/locale/locale\_methods.c in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5. (no CVSS)
- [CVE-2016-6595](https://cve.now/CVE-2016-6595.md): The SwarmKit toolkit 1.12.0 for Docker allows remote authenticated users to cause a denial of service (prevention of cluster joins) via a lo (no CVSS)
- [CVE-2016-8670](https://cve.now/CVE-2016-8670.md): Integer signedness error in the dynamicGetbuf function in gd\_io\_dp.c in the GD Graphics Library (aka libgd) through 2.2.3, as used in PHP be (no CVSS)
- [CVE-2016-8860](https://cve.now/CVE-2016-8860.md): Tor before 0.2.8.9 and 0.2.9.x before 0.2.9.4-alpha had internal functions that were entitled to expect that buf\_t data had NUL termination, (no CVSS)
- [CVE-2016-9137](https://cve.now/CVE-2016-9137.md): Use-after-free vulnerability in the CURLFile implementation in ext/curl/curl\_file.c in PHP before 5.6.27 and 7.x before 7.0.12 allows remote (no CVSS)
- [CVE-2016-9138](https://cve.now/CVE-2016-9138.md): PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during \_\_wakeup processing, which allows remote attackers to caus (no CVSS)
- [CVE-2016-9933](https://cve.now/CVE-2016-9933.md): Stack consumption vulnerability in the gdImageFillToBorder function in gd.c in the GD Graphics Library (aka libgd) before 2.2.2, as used in (no CVSS)
- [CVE-2016-9934](https://cve.now/CVE-2016-9934.md): ext/wddx/wddx.c in PHP before 5.6.28 and 7.x before 7.0.13 allows remote attackers to cause a denial of service (NULL pointer dereference) v (no CVSS)
- [CVE-2016-9935](https://cve.now/CVE-2016-9935.md): The php\_wddx\_push\_element function in ext/wddx/wddx.c in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial o (no CVSS)
- [CVE-2016-9936](https://cve.now/CVE-2016-9936.md): The unserialize implementation in ext/standard/var.c in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-afte (no CVSS)
- [CVE-2016-10115](https://cve.now/CVE-2016-10115.md): NETGEAR Arlo base stations with firmware 1.7.5\_6178 and earlier, Arlo Q devices with firmware 1.8.0\_5551 and earlier, and Arlo Q Plus device (no CVSS)
- [CVE-2016-10116](https://cve.now/CVE-2016-10116.md): NETGEAR Arlo base stations with firmware 1.7.5\_6178 and earlier, Arlo Q devices with firmware 1.8.0\_5551 and earlier, and Arlo Q Plus device (no CVSS)
- [CVE-2016-10112](https://cve.now/CVE-2016-10112.md): Cross-site scripting (XSS) vulnerability in the WooCommerce plugin before 2.6.9 for WordPress allows remote authenticated administrators to (no CVSS)
- [CVE-2016-10114](https://cve.now/CVE-2016-10114.md): SQL injection vulnerability in the "aWeb Cart Watching System for Virtuemart" extension before 2.6.1 for Joomla! allows remote attackers to (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.