# CVEs published 2017-05-02

21 CVEs were published on May 2, 2017: 1 critical, 0 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2014-9940](https://cve.now/CVE-2014-9940.md): The regulator\_ena\_gpio\_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or ca (no CVSS)
- [CVE-2015-9004](https://cve.now/CVE-2015-9004.md): kernel/events/core.c in the Linux kernel before 3.19 mishandles counter grouping, which allows local users to gain privileges via a crafted (no CVSS)
- [CVE-2017-0331](https://cve.now/CVE-2017-0331.md): An elevation of privilege vulnerability in the NVIDIA video driver could enable a local malicious application to execute arbitrary code with (no CVSS)
- [CVE-2017-7476](https://cve.now/CVE-2017-7476.md): Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. (no CVSS, Gnulib before 2017-04-26)
- [CVE-2017-8421](https://cve.now/CVE-2017-8421.md): The function coff\_set\_alignment\_hook in coffcode.h in Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.28 (no CVSS)
- [CVE-2017-7216](https://cve.now/CVE-2017-7216.md): The Management Web Interface in Palo Alto Networks PAN-OS before 7.1.9 allows remote authenticated users to obtain sensitive information via (no CVSS)
- [CVE-2015-8257](https://cve.now/CVE-2015-8257.md): The devtools.sh script in AXIS network cameras allows remote authenticated users to execute arbitrary commands via shell metacharacters in t (no CVSS)
- [CVE-2016-10243](https://cve.now/CVE-2016-10243.md): TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell\_escape\_commands in the texmf.cnf co (no CVSS)
- [CVE-2016-4442](https://cve.now/CVE-2016-4442.md): The rack-mini-profiler gem before 0.10.1 for Ruby allows remote attackers to obtain sensitive information about allocated strings and object (no CVSS, rack-mini-profiler)
- [CVE-2016-4467](https://cve.now/CVE-2016-4467.md): The C client and C-based client bindings in the Apache Qpid Proton library before 0.13.1 on Windows do not properly verify that the server h (no CVSS)
- [CVE-2016-5006](https://cve.now/CVE-2016-5006.md): The Cloud Controller in Cloud Foundry before 239 logs user-provided service objects at creation, which allows attackers to obtain sensitive (no CVSS)
- [CVE-2016-5063](https://cve.now/CVE-2016-5063.md): The RSCD agent in BMC Server Automation before 8.6 SP1 Patch 2 and 8.7 before Patch 3 on Windows might allow remote attackers to bypass auth (no CVSS)
- [CVE-2016-5810](https://cve.now/CVE-2016-5810.md): upAdminPg.asp in Advantech WebAccess before 8.1\_20160519 allows remote authenticated administrators to obtain sensitive password information (no CVSS)
- [CVE-2017-5689](https://cve.now/CVE-2017-5689.md): An unprivileged network attacker could gain system privileges to provisioned Intel manageability SKUs: Intel Active Management Technology (A (CVSS 9.8, KEV, Intel Active Mangement Technology, Intel Small Business Tec…)
- [CVE-2017-6551](https://cve.now/CVE-2017-6551.md): Pexip Infinity before 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors rela (no CVSS)
- [CVE-2017-7440](https://cve.now/CVE-2017-7440.md): Kerio Connect 8.0.0 through 9.2.2, and Kerio Connect Client desktop application for Windows and Mac 9.2.0 through 9.2.2, when e-mail preview (no CVSS)
- [CVE-2017-7483](https://cve.now/CVE-2017-7483.md): Rxvt 2.7.10 is vulnerable to a denial of service attack by passing the value -2^31 inside a terminal escape code, which results in a non-inv (no CVSS, The RXVT Project rxvt)
- [CVE-2017-8086](https://cve.now/CVE-2017-8086.md): Memory leak in the v9fs\_list\_xattr function in hw/9pfs/9p-xattr.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cau (no CVSS)
- [CVE-2017-8112](https://cve.now/CVE-2017-8112.md): hw/scsi/vmw\_pvscsi.c in QEMU (aka Quick Emulator) allows local guest OS privileged users to cause a denial of service (infinite loop and CPU (no CVSS)
- [CVE-2017-8418](https://cve.now/CVE-2017-8418.md): RuboCop 0.48.1 and earlier does not use /tmp in safe way, allowing local users to exploit this to tamper with cache files belonging to other (no CVSS, rubocop)
- [CVE-2017-8419](https://cve.now/CVE-2017-8419.md): LAME through 3.99.5 relies on the signed integer data type for values in a WAV or AIFF header, which allows remote attackers to cause a deni (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-05-02
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.