# CVEs published 2017-03-01

58 CVEs were published on March 1, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-8233](https://cve.now/CVE-2016-8233.md): Log files generated by Lenovo XClarity Administrator (LXCA) versions earlier than 1.2.2 may contain user credentials in a non-secure, clear (no CVSS, Lenovo Group XClarity Administrator)
- [CVE-2016-2879](https://cve.now/CVE-2016-2879.md): IBM QRadar 7.2 uses outdated hashing algorithms to hash certain passwords, which could allow a local user to obtain and decrypt user credent (no CVSS, IBM QRadar SIEM)
- [CVE-2016-2880](https://cve.now/CVE-2016-2880.md): IBM QRadar 7.2 stores the encryption key used to encrypt the service account password which can be obtained by a local user. (no CVSS, IBM QRadar SIEM)
- [CVE-2016-5932](https://cve.now/CVE-2016-5932.md): IBM Connections 4.0, 4.5, 5.0, and 5.5 is vulnerable to cross-site scripting. (no CVSS, IBM Connections)
- [CVE-2016-8232](https://cve.now/CVE-2016-8232.md): Document Object Model-(DOM) based cross-site scripting vulnerability in the Advanced Management Module (AMM) versions earlier than 66Z of Le (no CVSS, Lenovo IBM BladeCenter HS22, HS22V, HS23, HS23E, HX5 Earlie…)
- [CVE-2016-9992](https://cve.now/CVE-2016-9992.md): IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-9993](https://cve.now/CVE-2016-9993.md): IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2016-9994](https://cve.now/CVE-2016-9994.md): IBM Kenexa LCMS Premier on Cloud 9.0, and 10.0.0 is vulnerable to SQL injection. (no CVSS, IBM Kenexa LCMS Premier on Cloud)
- [CVE-2017-3826](https://cve.now/CVE-2017-3826.md): A vulnerability in the Stream Control Transmission Protocol (SCTP) decoder of the Cisco NetFlow Generation Appliance (NGA) with software bef (no CVSS, Cisco NetFlow Generation Appliance)
- [CVE-2016-10151](https://cve.now/CVE-2016-10151.md): The hesiod\_init function in lib/hesiod.c in Hesiod 3.2.1 compares EUID with UID to determine whether to use configurations from environment (no CVSS)
- [CVE-2016-5374](https://cve.now/CVE-2016-5374.md): NetApp Data ONTAP 9.0 and 9.1 before 9.1P1 allows remote authenticated users that own SMB-hosted data to bypass intended sharing restriction (no CVSS)
- [CVE-2016-6485](https://cve.now/CVE-2016-6485.md): The \_\_construct function in Framework/Encryption/Crypt.php in Magento 2 uses the PHP rand function to generate a random number for the initi (no CVSS, magento/community-edition · magento/project-community-editi…)
- [CVE-2016-9830](https://cve.now/CVE-2016-9830.md): The MagickRealloc function in memory.c in Graphicsmagick 1.3.25 allows remote attackers to cause a denial of service (crash) via large dimen (no CVSS)
- [CVE-2017-5995](https://cve.now/CVE-2017-5995.md): The NetApp ONTAP Select Deploy administration utility 2.0 through 2.2.1 might allow remote attackers to obtain sensitive information via uns (no CVSS)
- [CVE-2017-6345](https://cve.now/CVE-2017-6345.md): The LLC subsystem in the Linux kernel before 4.9.13 does not ensure that a certain destructor exists in required circumstances, which allows (no CVSS)
- [CVE-2017-6346](https://cve.now/CVE-2017-6346.md): Race condition in net/packet/af\_packet.c in the Linux kernel before 4.9.13 allows local users to cause a denial of service (use-after-free) (no CVSS)
- [CVE-2017-6347](https://cve.now/CVE-2017-6347.md): The ip\_cmsg\_recv\_checksum function in net/ipv4/ip\_sockglue.c in the Linux kernel before 4.10.1 has incorrect expectations about skb data lay (no CVSS)
- [CVE-2017-6348](https://cve.now/CVE-2017-6348.md): The hashbin\_delete function in net/irda/irqueue.c in the Linux kernel before 4.9.13 improperly manages lock dropping, which allows local use (no CVSS)
- [CVE-2017-6353](https://cve.now/CVE-2017-6353.md): net/sctp/socket.c in the Linux kernel through 4.10.1 does not properly restrict association peel-off operations during certain wait states, (no CVSS)
- [CVE-2017-2685](https://cve.now/CVE-2017-2685.md): Siemens SINUMERIK Integrate Operate Clients between 2.0.3.00.016 (including) and 2.0.6 (excluding) and between 3.0.4.00.032 (including) and (no CVSS, SINUMERIK Integrate Operate Clients 2.x and 3.x)
- [CVE-2016-10092](https://cve.now/CVE-2016-10092.md): Heap-based buffer overflow in the readContigStripsIntoBuffer function in tif\_unix.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0 (no CVSS)
- [CVE-2016-10093](https://cve.now/CVE-2016-10093.md): Integer overflow in tools/tiffcp.c in LibTIFF 4.0.7, 3.9.3, 3.9.4, 3.9.5, 3.9.6, 3.9.7, 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4 (no CVSS)
- [CVE-2016-10094](https://cve.now/CVE-2016-10094.md): Off-by-one error in the t2p\_readwrite\_pdf\_image\_tile function in tools/tiff2pdf.c in LibTIFF 4.0.7 allows remote attackers to have unspecifi (no CVSS)
- [CVE-2016-10095](https://cve.now/CVE-2016-10095.md): Stack-based buffer overflow in the \_TIFFVGetField function in tif\_dir.c in LibTIFF 4.0.0alpha4, 4.0.0alpha5, 4.0.0alpha6, 4.0.0beta7, 4.0.0, (no CVSS)
- [CVE-2016-8507](https://cve.now/CVE-2016-8507.md): Yandex Browser for iOS before 16.10.0.2357 does not properly restrict processing of facetime:// URLs, which allows remote attackers to initi (no CVSS, Yandex N.V. Yandex Browser for iOS)
- [CVE-2016-8508](https://cve.now/CVE-2016-8508.md): Yandex Browser for desktop before 17.1.1.227 does not show Protect (similar to Safebrowsing in Chromium) warnings in web-sites with special (no CVSS, Yandex N.V. Yandex Browser for desktop)
- [CVE-2016-9559](https://cve.now/CVE-2016-9559.md): coders/tiff.c in ImageMagick before 7.0.3.7 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a (no CVSS)
- [CVE-2016-9819](https://cve.now/CVE-2016-9819.md): libavcodec/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a nega (no CVSS)
- [CVE-2016-9820](https://cve.now/CVE-2016-9820.md): libavcodec/mpegvideo\_motion.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of (no CVSS)
- [CVE-2016-9821](https://cve.now/CVE-2016-9821.md): Integer overflow in libavcodec/mpegvideo\_parser.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted f (no CVSS)
- [CVE-2016-9822](https://cve.now/CVE-2016-9822.md): Integer overflow in libavcodec/mpeg12dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file. (no CVSS)
- [CVE-2016-9823](https://cve.now/CVE-2016-9823.md): libavcodec/x86/mpegvideo.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file. (no CVSS)
- [CVE-2016-9824](https://cve.now/CVE-2016-9824.md): Integer overflow in libswscale/x86/swscale.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via a crafted file. (no CVSS)
- [CVE-2016-9825](https://cve.now/CVE-2016-9825.md): libswscale/utils.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a negative (no CVSS)
- [CVE-2016-9826](https://cve.now/CVE-2016-9826.md): libavcodec/ituh263dec.c in libav 11.8 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of a neg (no CVSS)
- [CVE-2017-5498](https://cve.now/CVE-2017-5498.md): libjasper/include/jasper/jas\_math.h in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving le (no CVSS)
- [CVE-2017-5499](https://cve.now/CVE-2017-5499.md): Integer overflow in libjasper/jpc/jpc\_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted fi (no CVSS)
- [CVE-2017-5500](https://cve.now/CVE-2017-5500.md): libjasper/jpc/jpc\_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of (no CVSS)
- [CVE-2017-5501](https://cve.now/CVE-2017-5501.md): Integer overflow in libjasper/jpc/jpc\_tsfb.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via a crafted f (no CVSS)
- [CVE-2017-5502](https://cve.now/CVE-2017-5502.md): libjasper/jp2/jp2\_dec.c in JasPer 1.900.17 allows remote attackers to cause a denial of service (crash) via vectors involving left shift of (no CVSS)
- [CVE-2017-5503](https://cve.now/CVE-2017-5503.md): The dec\_clnpass function in libjasper/jpc/jpc\_t1dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memor (no CVSS)
- [CVE-2017-5504](https://cve.now/CVE-2017-5504.md): The jpc\_undo\_roi function in libjasper/jpc/jpc\_dec.c in JasPer 1.900.27 allows remote attackers to cause a denial of service (invalid memory (no CVSS)
- [CVE-2017-5665](https://cve.now/CVE-2017-5665.md): The splt\_cue\_export\_to\_file function in cue.c in libmp3splt 0.9.2 allows remote attackers to cause a denial of service (NULL pointer derefer (no CVSS)
- [CVE-2017-5666](https://cve.now/CVE-2017-5666.md): The free\_options function in options\_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (invalid free and crash (no CVSS)
- [CVE-2017-5851](https://cve.now/CVE-2017-5851.md): The free\_options function in options\_manager.c in mp3splt 2.6.2 allows remote attackers to cause a denial of service (NULL pointer dereferen (no CVSS)
- [CVE-2017-5852](https://cve.now/CVE-2017-5852.md): The PoDoFo::PdfPage::GetInheritedKeyFromObject function in base/PdfVariant.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of (no CVSS)
- [CVE-2017-5853](https://cve.now/CVE-2017-5853.md): Integer overflow in base/PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspecified impact via a crafted file. (no CVSS)
- [CVE-2017-5854](https://cve.now/CVE-2017-5854.md): base/PdfOutputStream.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a cra (no CVSS)
- [CVE-2017-5855](https://cve.now/CVE-2017-5855.md): The PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NU (no CVSS)
- [CVE-2017-5886](https://cve.now/CVE-2017-5886.md): Heap-based buffer overflow in the PoDoFo::PdfTokenizer::GetNextToken function in PdfTokenizer.cpp in PoDoFo 0.9.4 allows remote attackers to (no CVSS)
- [CVE-2017-5974](https://cve.now/CVE-2017-5974.md): Heap-based buffer overflow in the \_\_zzip\_get32 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 (no CVSS)
- [CVE-2017-5975](https://cve.now/CVE-2017-5975.md): Heap-based buffer overflow in the \_\_zzip\_get64 function in fetch.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0.13.57, 0.13.56 (no CVSS)
- [CVE-2017-5976](https://cve.now/CVE-2017-5976.md): Heap-based buffer overflow in the zzip\_mem\_entry\_extra\_block function in memdisk.c in zziplib 0.13.62, 0.13.61, 0.13.60, 0.13.59, 0.13.58, 0 (no CVSS)
- [CVE-2017-5977](https://cve.now/CVE-2017-5977.md): The zzip\_mem\_entry\_extra\_block function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (invalid memory (no CVSS)
- [CVE-2017-5978](https://cve.now/CVE-2017-5978.md): The zzip\_mem\_entry\_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (out-of-bounds read and (no CVSS)
- [CVE-2017-5979](https://cve.now/CVE-2017-5979.md): The prescan\_entry function in fseeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereference and (no CVSS)
- [CVE-2017-5980](https://cve.now/CVE-2017-5980.md): The zzip\_mem\_entry\_new function in memdisk.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (NULL pointer dereferen (no CVSS)
- [CVE-2017-5981](https://cve.now/CVE-2017-5981.md): seeko.c in zziplib 0.13.62 allows remote attackers to cause a denial of service (assertion failure and crash) via a crafted ZIP file. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-01
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.