# CVEs published 2017-01-19

39 CVEs were published on January 19, 2017: 0 critical, 1 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2016-5725](https://cve.now/CVE-2016-5725.md): Directory traversal vulnerability in JCraft JSch before 0.1.54 on Windows, when the mode is ChannelSftp.OVERWRITE, allows remote SFTP server (no CVSS, com.jcraft:jsch)
- [CVE-2015-8212](https://cve.now/CVE-2015-8212.md): CGI handling flaw in bozohttpd in NetBSD 6.0 through 6.0.6, 6.1 through 6.1.5, and 7.0 allows remote attackers to execute arbitrary code via (no CVSS)
- [CVE-2016-10075](https://cve.now/CVE-2016-10075.md): The tqdm.\_version module in tqdm versions 4.4.1 and 4.10 allows local users to execute arbitrary code via a crafted repo with a malicious gi (no CVSS, tqdm)
- [CVE-2016-7543](https://cve.now/CVE-2016-7543.md): Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables. (no CVSS)
- [CVE-2016-7545](https://cve.now/CVE-2016-7545.md): SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. (no CVSS)
- [CVE-2016-7793](https://cve.now/CVE-2016-7793.md): sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository URL. (no CVSS)
- [CVE-2016-7794](https://cve.now/CVE-2016-7794.md): sociomantic-tsunami git-hub before 0.10.3 allows remote attackers to execute arbitrary code via a crafted repository name. (no CVSS)
- [CVE-2016-9016](https://cve.now/CVE-2016-9016.md): Firejail 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call. (no CVSS)
- [CVE-2016-5196](https://cve.now/CVE-2016-5196.md): The content renderer client in Google Chrome prior to 54.0.2840.85 for Android insufficiently enforced the Same Origin Policy amongst downlo (no CVSS, Google Chrome prior to 54.0.2840.85 for Android)
- [CVE-2016-5197](https://cve.now/CVE-2016-5197.md): The content view client in Google Chrome prior to 54.0.2840.85 for Android insufficiently validated intent URLs, which allowed a remote atta (no CVSS, Google Chrome prior to 54.0.2840.85 for Android)
- [CVE-2016-5198](https://cve.now/CVE-2016-5198.md): V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect o (CVSS 8.8, KEV, Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.284…)
- [CVE-2016-5199](https://cve.now/CVE-2016-5199.md): An off by one error resulting in an allocation of zero size in FFmpeg in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for W (no CVSS, Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.…)
- [CVE-2016-5200](https://cve.now/CVE-2016-5200.md): V8 in Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.99 for Windows, and 54.0.2840.100 for Linux, and 55.0.2883.84 for Android i (no CVSS, Google Chrome prior to 54.0.2840.98 for Mac, and 54.0.2840.…)
- [CVE-2016-5201](https://cve.now/CVE-2016-5201.md): A leak of privateClass in the extensions API in Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.2840.99 for Windows, and 54.0.2840. (no CVSS, Google Chrome prior to 54.0.2840.100 for Linux, and 54.0.28…)
- [CVE-2016-5203](https://cve.now/CVE-2016-5203.md): A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5204](https://cve.now/CVE-2016-5204.md): Leaking of an SVG shadow tree leading to corruption of the DOM tree in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Lin (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5205](https://cve.now/CVE-2016-5205.md): Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac, incorrectly handles deferred page loads, which allowed a remote att (no CVSS, Google Chrome prior to 55.0.2883.75 for Linux, Windows and…)
- [CVE-2016-5206](https://cve.now/CVE-2016-5206.md): The PDF plugin in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly followed redirect (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5207](https://cve.now/CVE-2016-5207.md): In Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android, corruption of the DOM tree could o (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5208](https://cve.now/CVE-2016-5208.md): Blink in Google Chrome prior to 55.0.2883.75 for Linux and Windows, and 55.0.2883.84 for Android allowed possible corruption of the DOM tree (no CVSS, Google Chrome prior to 55.0.2883.75 for Linux and Windows,…)
- [CVE-2016-5209](https://cve.now/CVE-2016-5209.md): Bad casting in bitmap manipulation in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5210](https://cve.now/CVE-2016-5210.md): Heap buffer overflow during TIFF image parsing in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5211](https://cve.now/CVE-2016-5211.md): A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5212](https://cve.now/CVE-2016-5212.md): Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android insufficiently sanitized DevTools URLs, which a (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5213](https://cve.now/CVE-2016-5213.md): A use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote atta (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5214](https://cve.now/CVE-2016-5214.md): Google Chrome prior to 55.0.2883.75 for Windows mishandled downloaded files, which allowed a remote attacker to prevent the downloaded file (no CVSS, Google Chrome prior to 55.0.2883.75 for Windows)
- [CVE-2016-5215](https://cve.now/CVE-2016-5215.md): A use after free in webaudio in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remot (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5216](https://cve.now/CVE-2016-5216.md): A use after free in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5217](https://cve.now/CVE-2016-5217.md): The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly permitted acc (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5218](https://cve.now/CVE-2016-5218.md): The extensions API in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navig (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5219](https://cve.now/CVE-2016-5219.md): A heap use after free in V8 in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5220](https://cve.now/CVE-2016-5220.md): PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled navigation within (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5221](https://cve.now/CVE-2016-5221.md): Type confusion in libGLESv2 in ANGLE in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android possibl (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5222](https://cve.now/CVE-2016-5222.md): Incorrect handling of invalid URLs in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5223](https://cve.now/CVE-2016-5223.md): Integer overflow in PDFium in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android allowed a remote (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5224](https://cve.now/CVE-2016-5224.md): A timing attack on denormalized floating point arithmetic in SVG filters in Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows an (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5225](https://cve.now/CVE-2016-5225.md): Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled form actions, whic (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)
- [CVE-2016-5226](https://cve.now/CVE-2016-5226.md): Blink in Google Chrome prior to 55.0.2883.75 for Linux, Windows and Mac executed javascript: URLs entered in the URL bar in the context of t (no CVSS, Google Chrome prior to 55.0.2883.75 for Linux, Windows and…)
- [CVE-2016-9650](https://cve.now/CVE-2016-9650.md): Blink in Google Chrome prior to 55.0.2883.75 for Mac, Windows and Linux, and 55.0.2883.84 for Android incorrectly handled iframes, which all (no CVSS, Google Chrome prior to 55.0.2883.75 for Mac, Windows and Li…)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-19
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.