# CVEs published 2017-03-15

88 CVEs were published on March 15, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-3819](https://cve.now/CVE-2017-3819.md): A privilege escalation vulnerability in the Secure Shell (SSH) subsystem in the StarOS operating system for Cisco ASR 5000 Series, ASR 5500 (no CVSS, Cisco StarOS)
- [CVE-2017-3831](https://cve.now/CVE-2017-3831.md): A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to (no CVSS, Cisco Mobility Express 1800 Access Point Series)
- [CVE-2017-3846](https://cve.now/CVE-2017-3846.md): A vulnerability in the Client Manager Server of Cisco Workload Automation and Cisco Tidal Enterprise Scheduler could allow an unauthenticate (no CVSS, Cisco Workload Automation and Tidal Enterprise Scheduler Cl…)
- [CVE-2017-3854](https://cve.now/CVE-2017-3854.md): A vulnerability in the mesh code of Cisco Wireless LAN Controller (WLC) software could allow an unauthenticated, remote attacker to imperson (no CVSS, Cisco Meshed Wireless LAN Controller)
- [CVE-2015-8894](https://cve.now/CVE-2015-8894.md): Double free vulnerability in coders/tga.c in ImageMagick 7.0.0 and later allows remote attackers to cause a denial of service (application c (no CVSS)
- [CVE-2015-8895](https://cve.now/CVE-2015-8895.md): Integer overflow in coders/icon.c in ImageMagick 6.9.1-3 and later allows remote attackers to cause a denial of service (application crash) (no CVSS)
- [CVE-2015-8896](https://cve.now/CVE-2015-8896.md): Integer truncation issue in coders/pict.c in ImageMagick before 7.0.5-0 allows remote attackers to cause a denial of service (application cr (no CVSS)
- [CVE-2015-8897](https://cve.now/CVE-2015-8897.md): The SpliceImage function in MagickCore/transform.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (appli (no CVSS)
- [CVE-2015-8898](https://cve.now/CVE-2015-8898.md): The WriteImages function in magick/constitute.c in ImageMagick before 6.9.2-4 allows remote attackers to cause a denial of service (NULL poi (no CVSS)
- [CVE-2015-8982](https://cve.now/CVE-2015-8982.md): Integer overflow in the strxfrm function in the GNU C Library (aka glibc or libc6) before 2.21 allows context-dependent attackers to cause a (no CVSS)
- [CVE-2016-5239](https://cve.now/CVE-2016-5239.md): The gnuplot delegate functionality in ImageMagick before 6.9.4-0 and GraphicsMagick allows remote attackers to execute arbitrary commands vi (no CVSS)
- [CVE-2017-5849](https://cve.now/CVE-2017-5849.md): tiffttopnm in netpbm 10.47.63 does not properly use the libtiff TIFFRGBAImageGet function, which allows remote attackers to cause a denial o (no CVSS)
- [CVE-2017-5898](https://cve.now/CVE-2017-5898.md): Integer overflow in the emulated\_apdu\_from\_guest function in usb/dev-smartcard-reader.c in Quick Emulator (Qemu), when built with the CCID C (no CVSS)
- [CVE-2017-5937](https://cve.now/CVE-2017-5937.md): The util\_format\_is\_pure\_uint function in vrend\_renderer.c in Virgil 3d project (aka virglrenderer) 0.6.0 and earlier allows local guest OS u (no CVSS)
- [CVE-2016-7955](https://cve.now/CVE-2016-7955.md): The logcheck function in session.inc in AlienVault OSSIM before 5.3.1, when an action has been created, and USM before 5.3.1 allows remote a (no CVSS)
- [CVE-2017-5522](https://cve.now/CVE-2017-5522.md): Stack-based buffer overflow in MapServer before 6.0.6, 6.2.x before 6.2.4, 6.4.x before 6.4.5, and 7.0.x before 7.0.4 allows remote attacker (no CVSS)
- [CVE-2017-6914](https://cve.now/CVE-2017-6914.md): CSRF exists in BigTree CMS 4.1.18 and 4.2.16 with the id parameter to the admin/ajax/users/delete/ page. (no CVSS)
- [CVE-2017-6915](https://cve.now/CVE-2017-6915.md): CSRF exists in BigTree CMS 4.1.18 with the colophon parameter to the admin/settings/update/ page. (no CVSS)
- [CVE-2017-6916](https://cve.now/CVE-2017-6916.md): CSRF exists in BigTree CMS 4.1.18 with the nav-social\[#\] parameter to the admin/settings/update/ page. (no CVSS)
- [CVE-2017-6917](https://cve.now/CVE-2017-6917.md): CSRF exists in BigTree CMS 4.2.16 with the value parameter to the admin/settings/update/ page. (no CVSS)
- [CVE-2017-6918](https://cve.now/CVE-2017-6918.md): CSRF exists in BigTree CMS 4.2.16 with the value\[#\]\[\*\] parameter to the admin/settings/update/ page. (no CVSS)
- [CVE-2016-10155](https://cve.now/CVE-2016-10155.md): Memory leak in hw/watchdog/wdt\_i6300esb.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service ( (no CVSS)
- [CVE-2016-10163](https://cve.now/CVE-2016-10163.md): Memory leak in the vrend\_renderer\_context\_create\_internal function in vrend\_decode.c in virglrenderer before 0.6.0 allows local guest OS use (no CVSS)
- [CVE-2016-10166](https://cve.now/CVE-2016-10166.md): Integer underflow in the \_gdContributionsAlloc function in gd\_interpolation.c in the GD Graphics Library (aka libgd) before 2.2.4 allows rem (no CVSS)
- [CVE-2016-10167](https://cve.now/CVE-2016-10167.md): The gdImageCreateFromGd2Ctx function in gd\_gd2.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a deni (no CVSS)
- [CVE-2016-10168](https://cve.now/CVE-2016-10168.md): Integer overflow in gd\_io.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to have unspecified impact via vecto (no CVSS)
- [CVE-2016-10195](https://cve.now/CVE-2016-10195.md): The name\_parse function in evdns.c in libevent before 2.1.6-beta allows remote attackers to have unspecified impact via vectors involving th (no CVSS)
- [CVE-2016-10196](https://cve.now/CVE-2016-10196.md): Stack-based buffer overflow in the evutil\_parse\_sockaddr\_port function in evutil.c in libevent before 2.1.6-beta allows attackers to cause a (no CVSS)
- [CVE-2016-10197](https://cve.now/CVE-2016-10197.md): The search\_make\_new function in evdns.c in libevent before 2.1.6-beta allows attackers to cause a denial of service (out-of-bounds read) via (no CVSS)
- [CVE-2017-5358](https://cve.now/CVE-2017-5358.md): Stack-based buffer overflows in php\_Easycom5\_3\_0.dll in EasyCom for PHP 4.0.0.29 allows remote attackers to execute arbitrary code via the s (no CVSS)
- [CVE-2017-5359](https://cve.now/CVE-2017-5359.md): EasyCom SQL iPlug allows remote attackers to cause a denial of service via the D$EVAL parameter to the default URI. (no CVSS)
- [CVE-2017-5496](https://cve.now/CVE-2017-5496.md): Sawmill Enterprise 8.7.9 allows remote attackers to gain login access by leveraging knowledge of a password hash. (no CVSS)
- [CVE-2017-5525](https://cve.now/CVE-2017-5525.md): Memory leak in hw/audio/ac97.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memory (no CVSS)
- [CVE-2017-5526](https://cve.now/CVE-2017-5526.md): Memory leak in hw/audio/es1370.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (host memo (no CVSS)
- [CVE-2017-5537](https://cve.now/CVE-2017-5537.md): The password reset form in Weblate before 2.10.1 provides different error messages depending on whether the email address is associated with (no CVSS, weblate)
- [CVE-2017-5552](https://cve.now/CVE-2017-5552.md): Memory leak in the virgl\_resource\_attach\_backing function in hw/display/virtio-gpu-3d.c in QEMU (aka Quick Emulator) allows local guest OS u (no CVSS)
- [CVE-2017-5578](https://cve.now/CVE-2017-5578.md): Memory leak in the virtio\_gpu\_resource\_attach\_backing function in hw/display/virtio-gpu.c in QEMU (aka Quick Emulator) allows local guest OS (no CVSS)
- [CVE-2017-5579](https://cve.now/CVE-2017-5579.md): Memory leak in the serial\_exit\_core function in hw/char/serial.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to caus (no CVSS)
- [CVE-2017-5580](https://cve.now/CVE-2017-5580.md): The parse\_instruction function in gallium/auxiliary/tgsi/tgsi\_text.c in virglrenderer before 0.6.0 allows local guest OS users to cause a de (no CVSS)
- [CVE-2017-6189](https://cve.now/CVE-2017-6189.md): Untrusted search path vulnerability in Amazon Kindle for PC before 1.19 allows local users to execute arbitrary code and conduct DLL hijacki (no CVSS)
- [CVE-2017-6429](https://cve.now/CVE-2017-6429.md): Buffer overflow in the tcpcapinfo utility in Tcpreplay before 4.2.0 Beta 1 allows remote attackers to have unspecified impact via a pcap fil (no CVSS)
- [CVE-2017-6430](https://cve.now/CVE-2017-6430.md): The compile\_tree function in ef\_compiler.c in the Etterfilter utility in Ettercap 0.8.2 and earlier allows remote attackers to cause a denia (no CVSS)
- [CVE-2017-6443](https://cve.now/CVE-2017-6443.md): Cross-site scripting (XSS) vulnerability in EPSON TMNet WebConfig 1.00 allows remote attackers to inject arbitrary web script or HTML via th (no CVSS)
- [CVE-2016-10248](https://cve.now/CVE-2016-10248.md): The jpc\_tsfb\_synthesize function in jpc\_tsfb.c in JasPer before 1.900.9 allows remote attackers to cause a denial of service (NULL pointer d (no CVSS)
- [CVE-2016-10249](https://cve.now/CVE-2016-10249.md): Integer overflow in the jpc\_dec\_tiledecode function in jpc\_dec.c in JasPer before 1.900.12 allows remote attackers to have unspecified impac (no CVSS)
- [CVE-2016-10250](https://cve.now/CVE-2016-10250.md): The jp2\_colr\_destroy function in jp2\_cod.c in JasPer before 1.900.13 allows remote attackers to cause a denial of service (NULL pointer dere (no CVSS)
- [CVE-2016-10251](https://cve.now/CVE-2016-10251.md): Integer overflow in the jpc\_pi\_nextcprl function in jpc\_t2cod.c in JasPer before 1.900.20 allows remote attackers to have unspecified impact (no CVSS)
- [CVE-2016-6906](https://cve.now/CVE-2016-6906.md): The read\_image\_tga function in gd\_tga.c in the GD Graphics Library (aka libgd) before 2.2.4 allows remote attackers to cause a denial of ser (no CVSS)
- [CVE-2017-5583](https://cve.now/CVE-2017-5583.md): The Management Web Interface in Palo Alto Networks PAN-OS before 6.1.16, 7.0.x before 7.0.13, and 7.1.x before 7.1.8 allows remote authentic (no CVSS)
- [CVE-2017-5584](https://cve.now/CVE-2017-5584.md): Cross-site scripting (XSS) vulnerability in the Management Web Interface in Palo Alto Networks PAN-OS 5.1, 6.x before 6.1.16, 7.0.x before 7 (no CVSS)
- [CVE-2017-5938](https://cve.now/CVE-2017-5938.md): Cross-site scripting (XSS) vulnerability in the nav\_path function in lib/viewvc.py in ViewVC before 1.0.14 and 1.1.x before 1.1.26 allows re (no CVSS)
- [CVE-2017-5993](https://cve.now/CVE-2017-5993.md): Memory leak in the vrend\_renderer\_init\_blit\_ctx function in vrend\_blitter.c in virglrenderer before 0.6.0 allows local guest OS users to cau (no CVSS)
- [CVE-2017-5994](https://cve.now/CVE-2017-5994.md): Heap-based buffer overflow in the vrend\_create\_vertex\_elements\_state function in vrend\_renderer.c in virglrenderer before 0.6.0 allows local (no CVSS)
- [CVE-2017-6060](https://cve.now/CVE-2017-6060.md): Stack-based buffer overflow in jstest\_main.c in mujstest in Artifex Software, Inc. (no CVSS)
- [CVE-2017-6209](https://cve.now/CVE-2017-6209.md): Stack-based buffer overflow in the parse\_identifier function in tgsi\_text.c in the TGSI auxiliary module in the Gallium driver in virglrende (no CVSS)
- [CVE-2017-6210](https://cve.now/CVE-2017-6210.md): The vrend\_decode\_reset function in vrend\_decode.c in virglrenderer before 0.6.0 allows local guest OS users to cause a denial of service (NU (no CVSS)
- [CVE-2017-6317](https://cve.now/CVE-2017-6317.md): Memory leak in the add\_shader\_program function in vrend\_renderer.c in virglrenderer before 0.6.0 allows local guest OS users to cause a deni (no CVSS)
- [CVE-2017-6366](https://cve.now/CVE-2017-6366.md): Cross-site request forgery (CSRF) vulnerability in NETGEAR DGN2200 routers with firmware 10.0.0.20 through 10.0.0.50 allows remote attackers (no CVSS)
- [CVE-2017-6386](https://cve.now/CVE-2017-6386.md): Memory leak in the vrend\_create\_vertex\_elements\_state function in vrend\_renderer.c in virglrenderer allows local guest OS users to cause a d (no CVSS)
- [CVE-2017-6414](https://cve.now/CVE-2017-6414.md): Memory leak in the vcard\_apdu\_new function in card\_7816.c in libcacard before 2.5.3 allows local guest OS users to cause a denial of service (no CVSS)
- [CVE-2017-6435](https://cve.now/CVE-2017-6435.md): The parse\_string\_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory corrupt (no CVSS)
- [CVE-2017-6436](https://cve.now/CVE-2017-6436.md): The parse\_string\_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocat (no CVSS)
- [CVE-2017-6437](https://cve.now/CVE-2017-6437.md): The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) (no CVSS)
- [CVE-2017-6438](https://cve.now/CVE-2017-6438.md): Heap-based buffer overflow in the parse\_unicode\_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a de (no CVSS)
- [CVE-2017-6439](https://cve.now/CVE-2017-6439.md): Heap-based buffer overflow in the parse\_string\_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a den (no CVSS)
- [CVE-2017-6440](https://cve.now/CVE-2017-6440.md): The parse\_data\_node function in bplist.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (memory allocatio (no CVSS)
- [CVE-2017-6505](https://cve.now/CVE-2017-6505.md): The ohci\_service\_ed\_list function in hw/usb/hcd-ohci.c in QEMU (aka Quick Emulator) before 2.9.0 allows local guest OS users to cause a deni (no CVSS)
- [CVE-2017-6827](https://cve.now/CVE-2017-6827.md): Heap-based buffer overflow in the MSADPCM::initializeCoefficients function in MSADPCM.cpp in audiofile (aka libaudiofile and Audio File Libr (no CVSS)
- [CVE-2017-6828](https://cve.now/CVE-2017-6828.md): Heap-based buffer overflow in the readValue function in FileHandle.cpp in audiofile (aka libaudiofile and Audio File Library) 0.3.6 allows r (no CVSS)
- [CVE-2017-6840](https://cve.now/CVE-2017-6840.md): The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (inval (no CVSS)
- [CVE-2017-6841](https://cve.now/CVE-2017-6841.md): The GraphicsStack::TGraphicsStackElement::~TGraphicsStackElement function in graphicsstack.h in PoDoFo 0.9.5 allows remote attackers to caus (no CVSS)
- [CVE-2017-6842](https://cve.now/CVE-2017-6842.md): The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL (no CVSS)
- [CVE-2017-6843](https://cve.now/CVE-2017-6843.md): Heap-based buffer overflow in the PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to have u (no CVSS)
- [CVE-2017-6844](https://cve.now/CVE-2017-6844.md): Buffer overflow in the PoDoFo::PdfParser::ReadXRefSubsection function in PdfParser.cpp in PoDoFo 0.9.4 allows remote attackers to have unspe (no CVSS)
- [CVE-2017-6845](https://cve.now/CVE-2017-6845.md): The PoDoFo::PdfColor::operator function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL pointer d (no CVSS)
- [CVE-2017-6846](https://cve.now/CVE-2017-6846.md): The GraphicsStack::TGraphicsStackElement::SetNonStrokingColorSpace function in graphicsstack.h in PoDoFo 0.9.4 allows remote attackers to ca (no CVSS)
- [CVE-2017-6847](https://cve.now/CVE-2017-6847.md): The PoDoFo::PdfVariant::DelayedLoad function in PdfVariant.h in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL poin (no CVSS)
- [CVE-2017-6848](https://cve.now/CVE-2017-6848.md): The PoDoFo::PdfXObject::PdfXObject function in PdfXObject.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (NULL poi (no CVSS)
- [CVE-2017-6849](https://cve.now/CVE-2017-6849.md): The PoDoFo::PdfColorGray::~PdfColorGray function in PdfColor.cpp in PoDoFo 0.9.4 allows remote attackers to cause a denial of service (NULL (no CVSS)
- [CVE-2017-6850](https://cve.now/CVE-2017-6850.md): The jp2\_cdef\_destroy function in jp2\_cod.c in JasPer before 2.0.13 allows remote attackers to cause a denial of service (NULL pointer derefe (no CVSS)
- [CVE-2017-6851](https://cve.now/CVE-2017-6851.md): The jas\_matrix\_bindsub function in jas\_seq.c in JasPer 2.0.10 allows remote attackers to cause a denial of service (invalid read) via a craf (no CVSS)
- [CVE-2017-6852](https://cve.now/CVE-2017-6852.md): Heap-based buffer overflow in the jpc\_dec\_decodepkt function in jpc\_t2dec.c in JasPer 2.0.10 allows remote attackers to have unspecified imp (no CVSS)
- [CVE-2016-7103](https://cve.now/CVE-2016-7103.md): Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via (no CVSS, jquery-ui · jquery-ui-rails +2)
- [CVE-2017-6905](https://cve.now/CVE-2017-6905.md): An issue was discovered in concrete5 \<= 5.6.3.4. (no CVSS)
- [CVE-2017-6906](https://cve.now/CVE-2017-6906.md): An issue was discovered in SiberianCMS before 4.10.0. (no CVSS)
- [CVE-2017-6907](https://cve.now/CVE-2017-6907.md): An issue was discovered in Open.GL before 2017-03-13. (no CVSS)
- [CVE-2017-6908](https://cve.now/CVE-2017-6908.md): An issue was discovered in concrete5 \<= 5.6.3.4. (no CVSS)
- [CVE-2017-6909](https://cve.now/CVE-2017-6909.md): An issue was discovered in Shimmie \<= 2.5.1. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-03-15
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.