# CVEs published 2017-02-06 32 CVEs were published on February 6, 2017: 0 critical, 0 high. Days are UTC. - [CVE-2017-5677](https://cve.now/CVE-2017-5677.md): PEAR HTML\_AJAX 0.3.0 through 0.5.7 has a PHP Object Injection Vulnerability in the PHP Serializer. (no CVSS) - [CVE-2016-5102](https://cve.now/CVE-2016-5102.md): Buffer overflow in the readgifimage function in gif2tiff.c in the gif2tiff tool in LibTIFF 4.0.6 allows remote attackers to cause a denial o (no CVSS) - [CVE-2016-7446](https://cve.now/CVE-2016-7446.md): Buffer overflow in the MVG and SVG rendering code in GraphicsMagick 1.3.24 allows remote attackers to have unspecified impact via unknown ve (no CVSS) - [CVE-2016-7447](https://cve.now/CVE-2016-7447.md): Heap-based buffer overflow in the EscapeParenthesis function in GraphicsMagick before 1.3.25 allows remote attackers to have unspecified imp (no CVSS) - [CVE-2016-7448](https://cve.now/CVE-2016-7448.md): The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory al (no CVSS) - [CVE-2016-7449](https://cve.now/CVE-2016-7449.md): The TIFFGetField function in coders/tiff.c in GraphicsMagick 1.3.24 allows remote attackers to cause a denial of service (out-of-bounds heap (no CVSS) - [CVE-2016-7800](https://cve.now/CVE-2016-7800.md): Integer underflow in the parse8BIM function in coders/meta.c in GraphicsMagick 1.3.25 and earlier allows remote attackers to cause a denial (no CVSS) - [CVE-2016-9532](https://cve.now/CVE-2016-9532.md): Integer overflow in the writeBufferToSeparateStrips function in tiffcrop.c in LibTIFF before 4.0.7 allows remote attackers to cause a denial (no CVSS) - [CVE-2016-9772](https://cve.now/CVE-2016-9772.md): OpenAFS 1.6.19 and earlier allows remote attackers to obtain sensitive directory information via vectors involving the (1) client cache part (no CVSS) - [CVE-2017-5367](https://cve.now/CVE-2017-5367.md): Multiple reflected XSS vulnerabilities exist within form and link input parameters of ZoneMinder v1.30 and v1.29, an open-source CCTV server (no CVSS) - [CVE-2017-5368](https://cve.now/CVE-2017-5368.md): ZoneMinder v1.30 and v1.29, an open-source CCTV server web application, is vulnerable to CSRF (Cross Site Request Forgery) which allows a re (no CVSS) - [CVE-2017-5595](https://cve.now/CVE-2017-5595.md): A file disclosure and inclusion vulnerability exists in web/views/file.php in ZoneMinder 1.x through v1.30.0 because of unfiltered user-inpu (no CVSS) - [CVE-2015-2794](https://cve.now/CVE-2015-2794.md): The installation wizard in DotNetNuke (DNN) before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via (no CVSS, DotNetNuke.Core) - [CVE-2017-5875](https://cve.now/CVE-2017-5875.md): XSS was discovered in dotCMS 3.7.0, with an authenticated attack against the /myAccount addressID parameter. (no CVSS) - [CVE-2017-5876](https://cve.now/CVE-2017-5876.md): XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /news-events/events date parameter. (no CVSS) - [CVE-2017-5877](https://cve.now/CVE-2017-5877.md): XSS was discovered in dotCMS 3.7.0, with an unauthenticated attack against the /about-us/locations/index direction parameter. (no CVSS) - [CVE-2017-5879](https://cve.now/CVE-2017-5879.md): An issue was discovered in Exponent CMS 2.4.1. (no CVSS) - [CVE-2010-5328](https://cve.now/CVE-2010-5328.md): include/linux/init\_task.h in the Linux kernel before 2.6.35 does not prevent signals with a process group ID of zero from reaching the swapp (no CVSS) - [CVE-2016-10150](https://cve.now/CVE-2016-10150.md): Use-after-free vulnerability in the kvm\_ioctl\_create\_device function in virt/kvm/kvm\_main.c in the Linux kernel before 4.8.13 allows host OS (no CVSS) - [CVE-2016-10153](https://cve.now/CVE-2016-10153.md): The crypto scatterlist API in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG\_VMAP\_STACK option, which allows loca (no CVSS) - [CVE-2016-10154](https://cve.now/CVE-2016-10154.md): The smbhash function in fs/cifs/smbencrypt.c in the Linux kernel 4.9.x before 4.9.1 interacts incorrectly with the CONFIG\_VMAP\_STACK option, (no CVSS) - [CVE-2016-10208](https://cve.now/CVE-2016-10208.md): The ext4\_fill\_super function in fs/ext4/super.c in the Linux kernel through 4.9.8 does not properly validate meta block groups, which allows (no CVSS) - [CVE-2017-2583](https://cve.now/CVE-2017-2583.md): The load\_segment\_descriptor implementation in arch/x86/kvm/emulate.c in the Linux kernel before 4.9.5 improperly emulates a "MOV SS, NULL se (no CVSS) - [CVE-2017-2596](https://cve.now/CVE-2017-2596.md): The nested\_vmx\_check\_vmptr function in arch/x86/kvm/vmx.c in the Linux kernel through 4.9.8 improperly emulates the VMXON instruction, which (no CVSS) - [CVE-2017-5546](https://cve.now/CVE-2017-5546.md): The freelist-randomization feature in mm/slab.c in the Linux kernel 4.8.x and 4.9.x before 4.9.5 allows local users to cause a denial of ser (no CVSS) - [CVE-2017-5547](https://cve.now/CVE-2017-5547.md): drivers/hid/hid-corsair.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG\_VMAP\_STACK option, which allows local (no CVSS) - [CVE-2017-5548](https://cve.now/CVE-2017-5548.md): drivers/net/ieee802154/atusb.c in the Linux kernel 4.9.x before 4.9.6 interacts incorrectly with the CONFIG\_VMAP\_STACK option, which allows (no CVSS) - [CVE-2017-5549](https://cve.now/CVE-2017-5549.md): The klsi\_105\_get\_line\_state function in drivers/usb/serial/kl5kusb105.c in the Linux kernel before 4.9.5 places uninitialized heap-memory co (no CVSS) - [CVE-2017-5550](https://cve.now/CVE-2017-5550.md): Off-by-one error in the pipe\_advance function in lib/iov\_iter.c in the Linux kernel before 4.9.5 allows local users to obtain sensitive info (no CVSS) - [CVE-2017-5551](https://cve.now/CVE-2017-5551.md): The simple\_set\_acl function in fs/posix\_acl.c in the Linux kernel before 4.9.6 preserves the setgid bit during a setxattr call involving a t (no CVSS) - [CVE-2017-5576](https://cve.now/CVE-2017-5576.md): Integer overflow in the vc4\_get\_bcl function in drivers/gpu/drm/vc4/vc4\_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 a (no CVSS) - [CVE-2017-5577](https://cve.now/CVE-2017-5577.md): The vc4\_get\_bcl function in drivers/gpu/drm/vc4/vc4\_gem.c in the VideoCore DRM driver in the Linux kernel before 4.9.7 does not set an errno (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-02-06 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.