# CVEs published 2017-04-04

23 CVEs were published on April 4, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2016-3740](https://cve.now/CVE-2016-3740.md): Heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf\_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to (no CVSS)
- [CVE-2016-5870](https://cve.now/CVE-2016-5870.md): The msm\_ipc\_router\_close function in net/ipc\_router/ipc\_router\_socket.c in the ipc\_router component for the Linux kernel 3.x, as used in Qua (no CVSS)
- [CVE-2017-5649](https://cve.now/CVE-2017-5649.md): Apache Geode before 1.1.1, when a cluster has enabled security by setting the security-manager property, allows remote authenticated users w (no CVSS, Apache Software Foundation Apache Geode · org.apache.geode:…)
- [CVE-2015-1611](https://cve.now/CVE-2015-1611.md): OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to (no CVSS, org.opendaylight.openflowplugin:openflowplugin)
- [CVE-2015-1612](https://cve.now/CVE-2015-1612.md): OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to (no CVSS, org.opendaylight.openflowplugin:openflowplugin)
- [CVE-2017-0360](https://cve.now/CVE-2017-0360.md): file\_open in Tryton 3.x and 4.x through 4.2.2 allows remote authenticated users with certain permissions to read arbitrary files via a "same (no CVSS, tryton-server before 3.4.0-3+deb8u3 · trytond)
- [CVE-2017-7233](https://cve.now/CVE-2017-7233.md): Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an "on succes (no CVSS, django)
- [CVE-2017-7234](https://cve.now/CVE-2017-7234.md): A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the \`\`django.views.static.se (no CVSS, django)
- [CVE-2017-7418](https://cve.now/CVE-2017-7418.md): ProFTPD before 1.3.5e and 1.3.6 before 1.3.6rc5 controls whether the home directory of a user could contain a symbolic link through the Allo (no CVSS)
- [CVE-2016-10318](https://cve.now/CVE-2016-10318.md): A missing authorization check in the fscrypt\_process\_policy function in fs/crypto/policy.c in the ext4 and f2fs filesystem encryption suppor (no CVSS)
- [CVE-2017-5670](https://cve.now/CVE-2017-5670.md): Riverbed RiOS through 9.6.0 deletes the secure vault with the rm program (not shred or srm), which makes it easier for physically proximate (no CVSS)
- [CVE-2017-7305](https://cve.now/CVE-2017-7305.md): Riverbed RiOS through 9.6.0 does not require a bootloader password, which makes it easier for physically proximate attackers to defeat the s (CVSS 4.6)
- [CVE-2017-7306](https://cve.now/CVE-2017-7306.md): Riverbed RiOS through 9.6.0 has a weak default password for the secure vault, which makes it easier for physically proximate attackers to de (CVSS 6.4)
- [CVE-2017-7307](https://cve.now/CVE-2017-7307.md): Riverbed RiOS before 9.0.1 does not properly restrict shell access in single-user mode, which makes it easier for physically proximate attac (no CVSS)
- [CVE-2017-3204](https://cve.now/CVE-2017-3204.md): The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. (no CVSS, Go SSH library · golang.org/x/crypto)
- [CVE-2017-5683](https://cve.now/CVE-2017-5683.md): Privilege escalation in IntelHAXM.sys driver in the Intel Hardware Accelerated Execution Manager before version 6.0.6 allows a local user to (no CVSS, Intel Hardware Accelerated Execution Manager)
- [CVE-2017-7228](https://cve.now/CVE-2017-7228.md): An issue (known as XSA-212) was discovered in Xen, with fixes available for 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. (no CVSS)
- [CVE-2017-7398](https://cve.now/CVE-2017-7398.md): D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) vulnerability. (no CVSS)
- [CVE-2017-7413](https://cve.now/CVE-2017-7413.md): In Horde\_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an (no CVSS)
- [CVE-2017-7414](https://cve.now/CVE-2017-7414.md): In Horde\_Crypt before 2.7.6, as used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has P (no CVSS)
- [CVE-2014-9922](https://cve.now/CVE-2014-9922.md): The eCryptfs subsystem in the Linux kernel before 3.18 allows local users to gain privileges via a large filesystem stack that includes an o (no CVSS)
- [CVE-2016-10229](https://cve.now/CVE-2016-10229.md): udp.c in the Linux kernel before 4.5 allows remote attackers to execute arbitrary code via UDP traffic that triggers an unsafe second checks (no CVSS)
- [CVE-2017-7412](https://cve.now/CVE-2017-7412.md): NixOS 17.03 before 17.03.887 has a world-writable Docker socket, which allows local users to gain privileges by executing docker commands. (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-04-04
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.