# CVEs published 2017-02-27 30 CVEs were published on February 27, 2017: 0 critical, 3 high. Days are UTC. - [CVE-2015-8900](https://cve.now/CVE-2015-8900.md): The ReadHDRImage function in coders/hdr.c in ImageMagick 6.x and 7.x allows remote attackers to cause a denial of service (infinite loop) vi (no CVSS) - [CVE-2015-8901](https://cve.now/CVE-2015-8901.md): ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infinite loop) via a crafted MIFF file. (no CVSS) - [CVE-2015-8902](https://cve.now/CVE-2015-8902.md): The ReadBlobByte function in coders/pdb.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (infin (no CVSS) - [CVE-2015-8903](https://cve.now/CVE-2015-8903.md): The ReadVICARImage function in coders/vicar.c in ImageMagick 6.x before 6.9.0-5 Beta allows remote attackers to cause a denial of service (i (no CVSS) - [CVE-2016-10028](https://cve.now/CVE-2016-10028.md): The virgl\_cmd\_get\_capset function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support a (no CVSS) - [CVE-2016-10029](https://cve.now/CVE-2016-10029.md): The virtio\_gpu\_set\_scanout function in QEMU (aka Quick Emulator) built with Virtio GPU Device emulator support allows local guest OS users t (no CVSS) - [CVE-2016-5240](https://cve.now/CVE-2016-5240.md): The DrawDashPolygon function in magick/render.c in GraphicsMagick before 1.3.24 and the SVG renderer in ImageMagick allow remote attackers t (no CVSS) - [CVE-2016-7553](https://cve.now/CVE-2016-7553.md): The buf.pl script before 2.20 in Irssi before 0.8.20 uses weak permissions for the scrollbuffer dump file created between upgrades, which mi (no CVSS) - [CVE-2016-9815](https://cve.now/CVE-2016-9815.md): Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host panic) by sending an asynchronous abort. (no CVSS) - [CVE-2016-9816](https://cve.now/CVE-2016-9816.md): Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort whil (no CVSS) - [CVE-2016-9817](https://cve.now/CVE-2016-9817.md): Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving a (1) data or (2) prefetch (no CVSS) - [CVE-2016-9818](https://cve.now/CVE-2016-9818.md): Xen through 4.7.x allows local ARM guest OS users to cause a denial of service (host crash) via vectors involving an asynchronous abort whil (no CVSS) - [CVE-2016-8385](https://cve.now/CVE-2016-8385.md): An exploitable uninitialized variable vulnerability which leads to a stack-based buffer overflow exists in Iceni Argus. (CVSS 8.8, Iceni Argus) - [CVE-2016-8386](https://cve.now/CVE-2016-8386.md): An exploitable heap-based buffer overflow exists in Iceni Argus. (CVSS 8.8, Iceni Argus) - [CVE-2016-8387](https://cve.now/CVE-2016-8387.md): An exploitable heap-based buffer overflow exists in Iceni Argus. (CVSS 8.8, Iceni Argus) - [CVE-2016-8105](https://cve.now/CVE-2016-8105.md): Drivers for the Intel Ethernet Controller X710 and Intel Ethernet Controller XL710 families before version 22.0 are vulnerable to a denial o (no CVSS, Intel Ethernet Controller X710 family and Intel Ethernet Co…) - [CVE-2017-2682](https://cve.now/CVE-2017-2682.md): The Siemens web application RUGGEDCOM NMS \< V1.2 on port 8080/TCP and 8081/TCP could allow a remote attacker to perform a Cross-Site Request (no CVSS, RUGGEDCOM NMS All versions \<) - [CVE-2017-2683](https://cve.now/CVE-2017-2683.md): A non-privileged user of the Siemens web application RUGGEDCOM NMS \< V1.2 on port 8080/TCP and 8081/TCP could perform a persistent Cross-Sit (no CVSS, RUGGEDCOM NMS All versions \<) - [CVE-2017-5925](https://cve.now/CVE-2017-5925.md): Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern Intel p (no CVSS) - [CVE-2017-5926](https://cve.now/CVE-2017-5926.md): Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern AMD pro (no CVSS) - [CVE-2017-5927](https://cve.now/CVE-2017-5927.md): Page table walks conducted by the MMU during virtual to physical address translation leave a trace in the last level cache of modern ARM pro (no CVSS) - [CVE-2017-5928](https://cve.now/CVE-2017-5928.md): The W3C High Resolution Time API, as implemented in various web browsers, does not consider that memory-reference times can be measured by a (no CVSS) - [CVE-2017-5946](https://cve.now/CVE-2017-5946.md): The Zip::File component in the rubyzip gem before 1.2.1 for Ruby has a directory traversal vulnerability. (no CVSS, rubyzip) - [CVE-2017-6297](https://cve.now/CVE-2017-6297.md): The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-mid (no CVSS) - [CVE-2017-6341](https://cve.now/CVE-2017-6341.md): Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, and SmartPSS Software (no CVSS) - [CVE-2017-6342](https://cve.now/CVE-2017-6342.md): An issue was discovered on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-0 (no CVSS) - [CVE-2017-6343](https://cve.now/CVE-2017-6343.md): The web interface on Dahua DHI-HCVR7216A-S3 devices with NVR Firmware 3.210.0001.10 2016-06-06, Camera Firmware 2.400.0000.28.R 2016-03-29, (no CVSS) - [CVE-2017-6344](https://cve.now/CVE-2017-6344.md): XML External Entity (XXE) vulnerability in Grails PDF Plugin 0.6 allows remote attackers to read arbitrary files via a crafted XML document. (no CVSS) - [CVE-2017-6349](https://cve.now/CVE-2017-6349.md): An integer overflow at a u\_read\_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate valu (no CVSS) - [CVE-2017-6350](https://cve.now/CVE-2017-6350.md): An integer overflow at an unserialize\_uep memory allocation site would occur for vim before patch 8.0.0378, if it does not properly validate (no CVSS) --- Source: cve.now, built and run by Sazabi (AI-native observability and security) Page: https://cve.now/daily/2017-02-27 Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.