# CVEs published 2017-02-09

52 CVEs were published on February 9, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-5589](https://cve.now/CVE-2017-5589.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5590](https://cve.now/CVE-2017-5590.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5591](https://cve.now/CVE-2017-5591.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS, slixmpp · sleekxmpp)
- [CVE-2017-5592](https://cve.now/CVE-2017-5592.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5593](https://cve.now/CVE-2017-5593.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5602](https://cve.now/CVE-2017-5602.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5603](https://cve.now/CVE-2017-5603.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5604](https://cve.now/CVE-2017-5604.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5605](https://cve.now/CVE-2017-5605.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS, movim/moxl)
- [CVE-2017-5606](https://cve.now/CVE-2017-5606.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS)
- [CVE-2017-5858](https://cve.now/CVE-2017-5858.md): An incorrect implementation of "XEP-0280: Message Carbons" in multiple XMPP clients allows a remote attacker to impersonate any user, includ (no CVSS, converse.js)
- [CVE-2017-5941](https://cve.now/CVE-2017-5941.md): An issue was discovered in the node-serialize package 0.0.4 for Node.js. (no CVSS, node-serialize)
- [CVE-2017-5180](https://cve.now/CVE-2017-5180.md): Firejail before 0.9.44.4 and 0.9.38.x LTS before 0.9.38.8 LTS does not consider the .Xauthority case during its attempt to prevent accessing (no CVSS)
- [CVE-2017-5940](https://cve.now/CVE-2017-5940.md): Firejail before 0.9.44.6 and 0.9.38.x LTS before 0.9.38.10 LTS does not comprehensively address dotfile cases during its attempt to prevent (no CVSS)
- [CVE-2017-3807](https://cve.now/CVE-2017-3807.md): A vulnerability in Common Internet Filesystem (CIFS) code in the Clientless SSL VPN functionality of Cisco ASA Software, Major Releases 9.0- (no CVSS, Cisco ASA Software with Clientless SSL VPN portal is enable…)
- [CVE-2017-3813](https://cve.now/CVE-2017-3813.md): A vulnerability in the Start Before Logon (SBL) module of Cisco AnyConnect Secure Mobility Client Software for Windows could allow an unauth (no CVSS, Cisco AnyConnect Secure Mobility Client Software for Window…)
- [CVE-2017-5634](https://cve.now/CVE-2017-5634.md): The Norwegian Air Shuttle (aka norwegian.com) airline kiosk allows physically proximate attackers to bypass the intended "Please select book (no CVSS)
- [CVE-2015-6023](https://cve.now/CVE-2015-6023.md): ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01\_R05 allows remote attackers to bypas (no CVSS)
- [CVE-2015-6024](https://cve.now/CVE-2015-6024.md): ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01\_R05 allows remote authenticated user (no CVSS)
- [CVE-2015-8831](https://cve.now/CVE-2015-8831.md): Cross-site scripting (XSS) vulnerability in admin/comments.php in Dotclear before 2.8.2 allows remote attackers to inject arbitrary web scri (no CVSS)
- [CVE-2015-8832](https://cve.now/CVE-2015-8832.md): Multiple incomplete blacklist vulnerabilities in inc/core/class.dc.core.php in Dotclear before 2.8.2 allow remote authenticated users with " (no CVSS)
- [CVE-2015-8936](https://cve.now/CVE-2015-8936.md): Cross-site scripting (XSS) vulnerability in squidGuard.cgi in squidGuard before 1.5 allows remote attackers to inject arbitrary web script o (no CVSS)
- [CVE-2016-10190](https://cve.now/CVE-2016-10190.md): Heap-based buffer overflow in libavformat/http.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 all (no CVSS)
- [CVE-2016-10191](https://cve.now/CVE-2016-10191.md): Heap-based buffer overflow in libavformat/rtmppkt.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 (no CVSS)
- [CVE-2016-10192](https://cve.now/CVE-2016-10192.md): Heap-based buffer overflow in ffserver.c in FFmpeg before 2.8.10, 3.0.x before 3.0.5, 3.1.x before 3.1.6, and 3.2.x before 3.2.2 allows remo (no CVSS)
- [CVE-2016-10198](https://cve.now/CVE-2016-10198.md): The gst\_aac\_parse\_sink\_setcaps function in gst/audioparsers/gstaacparse.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attac (no CVSS)
- [CVE-2016-10199](https://cve.now/CVE-2016-10199.md): The qtdemux\_tag\_add\_str\_full function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to caus (no CVSS)
- [CVE-2016-2147](https://cve.now/CVE-2016-2147.md): Integer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to cause a denial of service (crash) via a mal (no CVSS)
- [CVE-2016-2148](https://cve.now/CVE-2016-2148.md): Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vecto (no CVSS)
- [CVE-2016-3101](https://cve.now/CVE-2016-3101.md): Cross-site scripting (XSS) vulnerability in the Extra Columns plugin before 1.17 in Jenkins allows remote attackers to inject arbitrary web (no CVSS, org.jenkins-ci.plugins:extra-columns)
- [CVE-2016-3102](https://cve.now/CVE-2016-3102.md): The Script Security plugin before 1.18.1 in Jenkins might allow remote attackers to bypass a Groovy sandbox protection mechanism via a plugi (no CVSS, org.jenkins-ci.plugins:script-security)
- [CVE-2016-4986](https://cve.now/CVE-2016-4986.md): Directory traversal vulnerability in the TAP plugin before 1.25 in Jenkins allows remote attackers to read arbitrary files via an unspecifie (no CVSS, org.tap4j:tap)
- [CVE-2016-4987](https://cve.now/CVE-2016-4987.md): Directory traversal vulnerability in the Image Gallery plugin before 1.4 in Jenkins allows remote attackers to list arbitrary directories an (no CVSS, com.tupilabs.image\_gallery:image-gallery)
- [CVE-2016-4988](https://cve.now/CVE-2016-4988.md): Cross-site scripting (XSS) vulnerability in the Build Failure Analyzer plugin before 1.16.0 in Jenkins allows remote attackers to inject arb (no CVSS, com.sonyericsson.jenkins.plugins.bfa:build-failure-analyzer)
- [CVE-2016-5726](https://cve.now/CVE-2016-5726.md): Packages.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP co (no CVSS)
- [CVE-2016-5727](https://cve.now/CVE-2016-5727.md): LogInOut.php in Simple Machines Forum (SMF) 2.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP co (no CVSS)
- [CVE-2016-6171](https://cve.now/CVE-2016-6171.md): Knot DNS before 2.3.0 allows remote DNS servers to cause a denial of service (memory exhaustion and slave server crash) via a large zone tra (no CVSS)
- [CVE-2016-6173](https://cve.now/CVE-2016-6173.md): NSD before 4.1.11 allows remote DNS master servers to cause a denial of service (/tmp disk consumption and slave server crash) via a zone tr (no CVSS)
- [CVE-2016-8494](https://cve.now/CVE-2016-8494.md): Insufficient verification of uploaded files allows attackers with webui administrators privileges to perform arbitrary code execution by upl (no CVSS, Fortinet Connect)
- [CVE-2016-9244](https://cve.now/CVE-2016-9244.md): A BIG-IP virtual server configured with a Client SSL profile that has the non-default Session Tickets option enabled may leak up to 31 bytes (no CVSS, F5 Networks F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, G…)
- [CVE-2017-5837](https://cve.now/CVE-2017-5837.md): The gst\_riff\_create\_audio\_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attac (no CVSS)
- [CVE-2017-5838](https://cve.now/CVE-2017-5838.md): The gst\_date\_time\_new\_from\_iso8601\_string function in gst/gstdatetime.c in GStreamer before 1.10.3 allows remote attackers to cause a denial (no CVSS)
- [CVE-2017-5839](https://cve.now/CVE-2017-5839.md): The gst\_riff\_create\_audio\_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 does not properly l (no CVSS)
- [CVE-2017-5840](https://cve.now/CVE-2017-5840.md): The qtdemux\_parse\_samples function in gst/isomp4/qtdemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cause a (no CVSS)
- [CVE-2017-5841](https://cve.now/CVE-2017-5841.md): The gst\_avi\_demux\_parse\_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cau (no CVSS)
- [CVE-2017-5842](https://cve.now/CVE-2017-5842.md): The html\_context\_handle\_element function in gst/subparse/samiparse.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attackers (no CVSS)
- [CVE-2017-5843](https://cve.now/CVE-2017-5843.md): Multiple use-after-free vulnerabilities in the (1) gst\_mini\_object\_unref, (2) gst\_tag\_list\_unref, and (3) gst\_mxf\_demux\_update\_essence\_track (no CVSS)
- [CVE-2017-5844](https://cve.now/CVE-2017-5844.md): The gst\_riff\_create\_audio\_caps function in gst-libs/gst/riff/riff-media.c in gst-plugins-base in GStreamer before 1.10.3 allows remote attac (no CVSS)
- [CVE-2017-5845](https://cve.now/CVE-2017-5845.md): The gst\_avi\_demux\_parse\_ncdt function in gst/avi/gstavidemux.c in gst-plugins-good in GStreamer before 1.10.3 allows remote attackers to cau (no CVSS)
- [CVE-2017-5846](https://cve.now/CVE-2017-5846.md): The gst\_asf\_demux\_process\_ext\_stream\_props function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer before 1.10.3 allows remo (no CVSS)
- [CVE-2017-5847](https://cve.now/CVE-2017-5847.md): The gst\_asf\_demux\_process\_ext\_content\_desc function in gst/asfdemux/gstasfdemux.c in gst-plugins-ugly in GStreamer allows remote attackers t (no CVSS)
- [CVE-2017-5848](https://cve.now/CVE-2017-5848.md): The gst\_ps\_demux\_parse\_psm function in gst/mpegdemux/gstmpegdemux.c in gst-plugins-bad in GStreamer allows remote attackers to cause a denia (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-02-09
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.