# CVEs published 2017-01-26

31 CVEs were published on January 26, 2017: 2 critical, 2 high. Days are UTC.

- [CVE-2016-8710](https://cve.now/CVE-2016-8710.md): An exploitable heap write out of bounds vulnerability exists in the decoding of BPG images in Libbpg library. (CVSS 7.5, Libbpg)
- [CVE-2016-9050](https://cve.now/CVE-2016-9050.md): An exploitable out-of-bounds read vulnerability exists in the client message-parsing functionality of Aerospike Database Server 3.10.0.3. (CVSS 8.2, Aerospike Database Server)
- [CVE-2016-9052](https://cve.now/CVE-2016-9052.md): An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. (CVSS 9.8, Aerospike)
- [CVE-2016-9054](https://cve.now/CVE-2016-9054.md): An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. (CVSS 9.8, Aerospike Database Server)
- [CVE-2016-8225](https://cve.now/CVE-2016-8225.md): Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to exec (no CVSS, Lenovo Group Edge and Slim USB Keyboard Driver)
- [CVE-2016-8226](https://cve.now/CVE-2016-8226.md): The BIOS in Lenovo System X M5, M6, and X6 systems allows administrators to cause a denial of service via updating a UEFI data structure. (no CVSS, Lenovo Group System X M5, M6, and X6 BIOS)
- [CVE-2016-8227](https://cve.now/CVE-2016-8227.md): Privilege escalation vulnerability in Lenovo Transition application used in Lenovo Yoga, Flex and Miix systems running Windows allows local (no CVSS, Lenovo Group Transition application)
- [CVE-2016-10013](https://cve.now/CVE-2016-10013.md): Xen through 4.8.x allows local 64-bit x86 HVM guest OS users to gain privileges by leveraging mishandling of SYSCALL singlestep during emula (no CVSS)
- [CVE-2016-10024](https://cve.now/CVE-2016-10024.md): Xen through 4.8.x allows local x86 PV guest OS kernel administrators to cause a denial of service (host hang or crash) by modifying the inst (no CVSS)
- [CVE-2016-10025](https://cve.now/CVE-2016-10025.md): VMFUNC emulation in Xen 4.6.x through 4.8.x on x86 systems using AMD virtualization extensions (aka SVM) allows local HVM guest OS users to (no CVSS)
- [CVE-2016-6908](https://cve.now/CVE-2016-6908.md): Characters from languages are such as Arabic, Hebrew are displayed from RTL (Right To Left) order in Opera 37.0.2192.105088 for Android, due (no CVSS)
- [CVE-2016-6911](https://cve.now/CVE-2016-6911.md): The dynamicGetbuf function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (out-of- (no CVSS)
- [CVE-2016-6912](https://cve.now/CVE-2016-6912.md): Double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have (no CVSS)
- [CVE-2016-9317](https://cve.now/CVE-2016-9317.md): The gdImageCreate function in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of service (system (no CVSS)
- [CVE-2016-9932](https://cve.now/CVE-2016-9932.md): CMPXCHG8B emulation in Xen 3.3.x through 4.7.x on x86 systems allows local HVM guest OS users to obtain sensitive information from host stac (no CVSS)
- [CVE-2016-9216](https://cve.now/CVE-2016-9216.md): An IKE Packet Parsing Denial of Service Vulnerability in the ipsecmgr process of Cisco ASR 5000 Software could allow an unauthenticated, rem (no CVSS, Cisco ASR 5000 Software)
- [CVE-2016-9218](https://cve.now/CVE-2016-9218.md): A vulnerability in Cisco Hybrid Meeting Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF (no CVSS, Cisco Hybrid Meeting Server)
- [CVE-2016-9220](https://cve.now/CVE-2016-9220.md): A Denial of Service Vulnerability in 802.11 ingress packet processing of the Cisco Mobility Express 2800 and 3800 Access Points (APs) could (no CVSS, Cisco Mobility Express 2800 and)
- [CVE-2016-9221](https://cve.now/CVE-2016-9221.md): A Denial of Service Vulnerability in 802.11 ingress connection authentication handling for the Cisco Mobility Express 2800 and 3800 Access P (no CVSS, Cisco Mobility Express 2800 Series and 3800 Series Access P…)
- [CVE-2016-9222](https://cve.now/CVE-2016-9222.md): A vulnerability in the web-based management interface of Cisco NetFlow Generation Appliance could allow an unauthenticated, remote attacker (no CVSS, Cisco NetFlow Generation Appliance)
- [CVE-2017-3794](https://cve.now/CVE-2017-3794.md): A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to conduct a cross-site request forgery (CSRF (no CVSS, Cisco WebEx Meetings Server)
- [CVE-2017-3795](https://cve.now/CVE-2017-3795.md): A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to conduct arbitrary password changes against a (no CVSS, Cisco WebEx Meetings Server)
- [CVE-2017-3796](https://cve.now/CVE-2017-3796.md): A vulnerability in Cisco WebEx Meetings Server could allow an authenticated, remote attacker to execute predetermined shell commands on othe (no CVSS, Cisco WebEx Meetings Server)
- [CVE-2017-3797](https://cve.now/CVE-2017-3797.md): A vulnerability in Cisco WebEx Meetings Server could allow an unauthenticated, remote attacker to view the fully qualified domain name of th (no CVSS, Cisco WebEx Meetings Server)
- [CVE-2017-3798](https://cve.now/CVE-2017-3798.md): A cross-site scripting (XSS) filter bypass vulnerability in the web-based management interface of Cisco Unified Communications Manager could (no CVSS, Cisco Unified Communications Manager)
- [CVE-2017-3799](https://cve.now/CVE-2017-3799.md): A vulnerability in a URL parameter of Cisco WebEx Meeting Center could allow an unauthenticated, remote attacker to perform site redirection (no CVSS, Cisco WebEx Meeting Center T28.1)
- [CVE-2017-3800](https://cve.now/CVE-2017-3800.md): A vulnerability in the content scanning engine of Cisco AsyncOS Software for Cisco Email Security Appliances (ESA) could allow an unauthenti (no CVSS, Cisco AsyncOS)
- [CVE-2017-3802](https://cve.now/CVE-2017-3802.md): A vulnerability in Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to conduct a cross-site scripting (X (no CVSS, Cisco Unified Communications Manager)
- [CVE-2017-3803](https://cve.now/CVE-2017-3803.md): A vulnerability in the Cisco IOS Software forwarding queue of Cisco 2960X and 3750X switches could allow an unauthenticated, adjacent attack (no CVSS, Cisco IOS)
- [CVE-2017-3804](https://cve.now/CVE-2017-3804.md): A vulnerability in Intermediate System-to-Intermediate System (IS-IS) protocol packet processing of Cisco Nexus 5000, 6000, and 7000 Series (no CVSS, Cisco Nexus 5000, 6000,)
- [CVE-2017-3805](https://cve.now/CVE-2017-3805.md): A vulnerability in the web-based management interface of Cisco IOS and Cisco IOx Software could allow an unauthenticated, remote attacker to (no CVSS, Cisco IOS and Cisco IOx)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-01-26
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.