# CVEs published 2017-01-13

41 CVEs were published on January 13, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2010-5327](https://cve.now/CVE-2010-5327.md): Liferay Portal through 6.2.10 allows remote authenticated users to execute arbitrary shell commands via a crafted Velocity template. (no CVSS, com.liferay.portal:portal-impl · com.liferay.portal:portal-…)
- [CVE-2016-2090](https://cve.now/CVE-2016-2090.md): Off-by-one vulnerability in the fgetwln function in libbsd before 0.8.2 allows attackers to have unspecified impact via unknown vectors, whi (no CVSS)
- [CVE-2016-6885](https://cve.now/CVE-2016-6885.md): The pstm\_exptmod function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid free and crash) via a base (no CVSS)
- [CVE-2016-6886](https://cve.now/CVE-2016-6886.md): The pstm\_reverse function in MatrixSSL before 3.8.4 allows remote attackers to cause a denial of service (invalid memory read and crash) via (no CVSS)
- [CVE-2016-6887](https://cve.now/CVE-2016-6887.md): The pstm\_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attacker (no CVSS)
- [CVE-2016-7426](https://cve.now/CVE-2016-7426.md): NTP before 4.2.8p9 rate limits responses received from the configured sources when rate limiting for all associations is enabled, which allo (no CVSS)
- [CVE-2016-7427](https://cve.now/CVE-2016-7427.md): The broadcast mode replay prevention functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (rejec (no CVSS)
- [CVE-2016-7428](https://cve.now/CVE-2016-7428.md): ntpd in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (reject broadcast mode packets) via the poll interval in a b (no CVSS)
- [CVE-2016-7429](https://cve.now/CVE-2016-7429.md): NTP before 4.2.8p9 changes the peer structure to the interface it receives the response from a source, which allows remote attackers to caus (no CVSS)
- [CVE-2016-7431](https://cve.now/CVE-2016-7431.md): NTP before 4.2.8p9 allows remote attackers to bypass the origin timestamp protection mechanism via an origin timestamp of zero. (no CVSS)
- [CVE-2016-7433](https://cve.now/CVE-2016-7433.md): NTP before 4.2.8p9 does not properly perform the initial sync calculations, which allows remote attackers to unspecified impact via unknown (no CVSS)
- [CVE-2016-7434](https://cve.now/CVE-2016-7434.md): The read\_mru\_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query. (no CVSS)
- [CVE-2016-8467](https://cve.now/CVE-2016-8467.md): An elevation of privilege vulnerability in the bootloader could enable a local attacker to execute arbitrary modem commands on the device. (no CVSS, Google Android)
- [CVE-2016-8671](https://cve.now/CVE-2016-8671.md): The pstm\_exptmod function in MatrixSSL 3.8.6 and earlier does not properly perform modular exponentiation, which might allow remote attacker (no CVSS)
- [CVE-2016-8882](https://cve.now/CVE-2016-8882.md): The jpc\_dec\_tilefini function in libjasper/jpc/jpc\_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (NULL (no CVSS)
- [CVE-2016-8883](https://cve.now/CVE-2016-8883.md): The jpc\_dec\_tiledecode function in jpc\_dec.c in JasPer before 1.900.8 allows remote attackers to cause a denial of service (assertion failur (no CVSS)
- [CVE-2016-9107](https://cve.now/CVE-2016-9107.md): The OTR plugin for Gajim sends information in cleartext when using XHTML, which allows remote attackers to obtain sensitive information via (no CVSS)
- [CVE-2016-9310](https://cve.now/CVE-2016-9310.md): The control mode (mode 6) functionality in ntpd in NTP before 4.2.8p9 allows remote attackers to set or unset traps via a crafted control mo (no CVSS)
- [CVE-2016-9311](https://cve.now/CVE-2016-9311.md): ntpd in NTP before 4.2.8p9, when the trap service is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference (no CVSS)
- [CVE-2016-9312](https://cve.now/CVE-2016-9312.md): ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet. (no CVSS)
- [CVE-2016-9807](https://cve.now/CVE-2016-9807.md): The flx\_decode\_chunks function in gst/flx/gstflxdec.c in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (inval (no CVSS)
- [CVE-2016-9808](https://cve.now/CVE-2016-9808.md): The FLIC decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (out-of-bounds write and crash) via a craft (no CVSS)
- [CVE-2016-9809](https://cve.now/CVE-2016-9809.md): Off-by-one error in the gst\_h264\_parse\_set\_caps function in GStreamer before 1.10.2 allows remote attackers to have unspecified impact via a (no CVSS)
- [CVE-2016-9810](https://cve.now/CVE-2016-9810.md): The gst\_decode\_chain\_free\_internal function in the flxdex decoder in gst-plugins-good in GStreamer before 1.10.2 allows remote attackers to (no CVSS)
- [CVE-2016-9811](https://cve.now/CVE-2016-9811.md): The windows\_icon\_typefind function in gst-plugins-base in GStreamer before 1.10.2, when G\_SLICE is set to always-malloc, allows remote attac (no CVSS)
- [CVE-2016-9812](https://cve.now/CVE-2016-9812.md): The gst\_mpegts\_section\_new function in the mpegts decoder in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (o (no CVSS)
- [CVE-2016-9813](https://cve.now/CVE-2016-9813.md): The \_parse\_pat function in the mpegts parser in GStreamer before 1.10.2 allows remote attackers to cause a denial of service (NULL pointer d (no CVSS)
- [CVE-2017-0398](https://cve.now/CVE-2017-0398.md): An information disclosure vulnerability in Audioserver could enable a local malicious application to access data outside of its permission l (no CVSS, Google Android)
- [CVE-2015-3188](https://cve.now/CVE-2015-3188.md): The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors. (no CVSS, org.apache.storm:storm)
- [CVE-2016-10135](https://cve.now/CVE-2016-10135.md): An issue was discovered on LG devices using the MTK chipset with L(5.0/5.1), M(6.0/6.0.1), and N(7.0) software, and RCA Voyager Tablet, BLU (no CVSS)
- [CVE-2016-10136](https://cve.now/CVE-2016-10136.md): An issue was discovered on BLU R1 HD devices with Shanghai Adups software. (no CVSS)
- [CVE-2016-10137](https://cve.now/CVE-2016-10137.md): An issue was discovered on BLU R1 HD devices with Shanghai Adups software. (no CVSS)
- [CVE-2016-10138](https://cve.now/CVE-2016-10138.md): An issue was discovered on BLU Advance 5.0 and BLU R1 HD devices with Shanghai Adups software. (no CVSS)
- [CVE-2016-10139](https://cve.now/CVE-2016-10139.md): An issue was discovered on BLU R1 HD devices with Shanghai Adups software. (no CVSS)
- [CVE-2016-10140](https://cve.now/CVE-2016-10140.md): Information disclosure and authentication bypass vulnerability exists in the Apache HTTP Server configuration bundled with ZoneMinder v1.30 (no CVSS)
- [CVE-2016-10141](https://cve.now/CVE-2016-10141.md): An integer overflow vulnerability was observed in the regemit function in regexp.c in Artifex Software, Inc. (no CVSS)
- [CVE-2016-3128](https://cve.now/CVE-2016-3128.md): A spoofing vulnerability in the Core of BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows remote attackers to enroll an illegitima (no CVSS, BES12 versions through)
- [CVE-2016-3130](https://cve.now/CVE-2016-3130.md): An information disclosure vulnerability in the Core and Management Console in BlackBerry Enterprise Server (BES) 12 through 12.5.2 allows re (no CVSS, BES12 versions through)
- [CVE-2016-9882](https://cve.now/CVE-2016-9882.md): An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v250 and CAPI-release versions prior to v1.12.0. (no CVSS, Cloud Foundry Foundation cf-release versions prior to v250…)
- [CVE-2017-3890](https://cve.now/CVE-2017-3890.md): A reflected cross-site scripting vulnerability in the BlackBerry WatchDox Server components Appliance-X, version 1.8.1 and earlier, and vAPP (no CVSS, BlackBerry WatchDox Server)
- [CVE-2017-5364](https://cve.now/CVE-2017-5364.md): Memory Corruption Vulnerability in Foxit PDF Toolkit v1.3 allows an attacker to cause Denial of Service and Remote Code Execution when the v (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-13
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.