# CVEs published 2017-06-06

49 CVEs were published on June 6, 2017: 0 critical, 0 high. Days are UTC.

- [CVE-2017-9461](https://cve.now/CVE-2017-9461.md): smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd\_open\_atomic infinite loop with high CPU usage a (no CVSS)
- [CVE-2017-9462](https://cve.now/CVE-2017-9462.md): In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and consequently execute arbi (no CVSS, mercurial)
- [CVE-2017-9465](https://cve.now/CVE-2017-9465.md): The yr\_arena\_write\_data function in YARA 3.6.1 allows remote attackers to cause a denial of service (buffer over-read and application crash) (no CVSS)
- [CVE-2014-8180](https://cve.now/CVE-2014-8180.md): MongoDB on Red Hat Satellite 6 allows local users to bypass authentication by logging in with an empty password and delete information which (no CVSS)
- [CVE-2015-1207](https://cve.now/CVE-2015-1207.md): Double-free vulnerability in libavformat/mov.c in FFMPEG in Google Chrome 41.0.2251.0 allows remote attackers to cause a denial of service ( (no CVSS)
- [CVE-2015-3830](https://cve.now/CVE-2015-3830.md): The stock Android browser address bar in all Android operating systems suffers from Address Bar Spoofing, which allows remote attackers to t (no CVSS)
- [CVE-2016-0726](https://cve.now/CVE-2016-0726.md): The Fedora Nagios package uses "nagiosadmin" as the default password for the "nagiosadmin" administrator account, which makes it easier for (no CVSS)
- [CVE-2016-0767](https://cve.now/CVE-2016-0767.md): PostgreSQL PL/Java before 1.5.0 allows remote authenticated users with USAGE permission on the public schema to alter the public schema clas (no CVSS, postgresql:pljava-public)
- [CVE-2016-0768](https://cve.now/CVE-2016-0768.md): PostgreSQL PL/Java after 9.0 does not honor access controls on large objects. (no CVSS)
- [CVE-2016-2192](https://cve.now/CVE-2016-2192.md): PostgreSQL PL/Java before 1.5.0 allows remote authenticated users to alter type mappings for types they do not own. (no CVSS)
- [CVE-2016-3066](https://cve.now/CVE-2016-3066.md): The spice-gtk widget allows remote authenticated users to obtain information from the host clipboard. (no CVSS)
- [CVE-2016-3077](https://cve.now/CVE-2016-3077.md): The VersionMapper.fromKernelVersionString method in oVirt Engine allows remote authenticated users to cause a denial of service (process cra (no CVSS)
- [CVE-2016-5004](https://cve.now/CVE-2016-5004.md): The Content-Encoding HTTP header feature in ws-xmlrpc 3.1.3 as used in Apache Archiva allows remote attackers to cause a denial of service ( (no CVSS, org.apache.xmlrpc:xmlrpc-common)
- [CVE-2016-9960](https://cve.now/CVE-2016-9960.md): game-music-emu before 0.6.1 allows local users to cause a denial of service (divide by zero and process crash). (no CVSS)
- [CVE-2016-9961](https://cve.now/CVE-2016-9961.md): game-music-emu before 0.6.1 mishandles unspecified integer values. (no CVSS)
- [CVE-2017-5243](https://cve.now/CVE-2017-5243.md): The default SSH configuration in Rapid7 Nexpose hardware appliances shipped before June 2017 does not specify desired algorithms for key exc (no CVSS, Rapid7 Nexpose hardware appliance)
- [CVE-2017-8920](https://cve.now/CVE-2017-8920.md): irc.cgi in CGI:IRC before 0.5.12 reflects user-supplied input from the R parameter without proper output encoding, aka XSS. (no CVSS)
- [CVE-2017-9451](https://cve.now/CVE-2017-9451.md): Cross site scripting (XSS) vulnerability in pages.edit\_form.php in flatCore 1.4.6 allows remote attackers to inject arbitrary JavaScript via (no CVSS)
- [CVE-2017-9452](https://cve.now/CVE-2017-9452.md): Cross-site scripting (XSS) vulnerability in admin.php in Piwigo 2.9.0 and earlier allows remote attackers to inject arbitrary web script or (no CVSS)
- [CVE-2017-9448](https://cve.now/CVE-2017-9448.md): Cross-site scripting (XSS) vulnerabilities in BigTree CMS through 4.2.18 allow remote authenticated users to inject arbitrary web script or (no CVSS)
- [CVE-2017-9449](https://cve.now/CVE-2017-9449.md): SQL injection vulnerability in BigTree CMS through 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via core/admin (no CVSS)
- [CVE-2014-9923](https://cve.now/CVE-2014-9923.md): In NAS in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially (no CVSS, All Qualcomm products)
- [CVE-2014-9924](https://cve.now/CVE-2014-9924.md): In 1x in all Android releases from CAF using the Linux kernel, a Signed to Unsigned Conversion Error could potentially occur. (no CVSS, All Qualcomm products)
- [CVE-2014-9925](https://cve.now/CVE-2014-9925.md): In HDR in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially (no CVSS, All Qualcomm products)
- [CVE-2014-9926](https://cve.now/CVE-2014-9926.md): In GNSS in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9927](https://cve.now/CVE-2014-9927.md): In UIM in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potentially (no CVSS, All Qualcomm products)
- [CVE-2014-9928](https://cve.now/CVE-2014-9928.md): In GERAN in all Android releases from CAF using the Linux kernel, a Buffer Copy without Checking Size of Input vulnerability could potential (no CVSS, All Qualcomm products)
- [CVE-2014-9929](https://cve.now/CVE-2014-9929.md): In WCDMA in all Android releases from CAF using the Linux kernel, a Use of Out-of-range Pointer Offset vulnerability could potentially exist (no CVSS, All Qualcomm products)
- [CVE-2014-9930](https://cve.now/CVE-2014-9930.md): In WCDMA in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9941](https://cve.now/CVE-2014-9941.md): In the Embedded File System in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerabilit (no CVSS, All Qualcomm products)
- [CVE-2014-9942](https://cve.now/CVE-2014-9942.md): In Boot in all Android releases from CAF using the Linux kernel, a Use of Uninitialized Variable vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9943](https://cve.now/CVE-2014-9943.md): In Core Kernel in all Android releases from CAF using the Linux kernel, a Null Pointer Dereference vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9944](https://cve.now/CVE-2014-9944.md): In the Secure File System in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability coul (no CVSS, All Qualcomm products)
- [CVE-2014-9945](https://cve.now/CVE-2014-9945.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9946](https://cve.now/CVE-2014-9946.md): In Core Kernel in all Android releases from CAF using the Linux kernel, a Use After Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9947](https://cve.now/CVE-2014-9947.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9948](https://cve.now/CVE-2014-9948.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Improper Validation of Array Index vulnerability could potentially (no CVSS, All Qualcomm products)
- [CVE-2014-9949](https://cve.now/CVE-2014-9949.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Untrusted Pointer Dereference vulnerability could potentially exist (no CVSS, All Qualcomm products)
- [CVE-2014-9950](https://cve.now/CVE-2014-9950.md): In Core Kernel in all Android releases from CAF using the Linux kernel, an Improper Authorization vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2014-9951](https://cve.now/CVE-2014-9951.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Information Exposure Through Timing Discrepancy vulnerability could (no CVSS, All Qualcomm products)
- [CVE-2014-9952](https://cve.now/CVE-2014-9952.md): In the Secure File System in all Android releases from CAF using the Linux kernel, a capture-replay vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2015-9005](https://cve.now/CVE-2015-9005.md): In TrustZone in all Android releases from CAF using the Linux kernel, an Integer Overflow to Buffer Overflow vulnerability could potentially (no CVSS, All Qualcomm products)
- [CVE-2015-9006](https://cve.now/CVE-2015-9006.md): In Resource Power Manager (RPM) in all Android releases from CAF using the Linux kernel, an Improper Access Control vulnerability could pote (no CVSS, All Qualcomm products)
- [CVE-2015-9007](https://cve.now/CVE-2015-9007.md): In TrustZone in all Android releases from CAF using the Linux kernel, a Double Free vulnerability could potentially exist. (no CVSS, All Qualcomm products)
- [CVE-2016-10297](https://cve.now/CVE-2016-10297.md): In TrustZone in all Android releases from CAF using the Linux kernel, a Time-of-Check Time-of-Use Race Condition vulnerability could potenti (no CVSS, All Qualcomm products)
- [CVE-2017-5664](https://cve.now/CVE-2017-5664.md): The error page mechanism of the Java Servlet Specification requires that, when an error occurs and an error page is configured for the error (no CVSS, Apache Software Foundation Apache Tomcat · org.apache.tomca…)
- [CVE-2017-7515](https://cve.now/CVE-2017-7515.md): poppler through version 0.55.0 is vulnerable to an uncontrolled recursion in pdfunite resulting into potential denial-of-service. (no CVSS, Red Hat poppler)
- [CVE-2017-8083](https://cve.now/CVE-2017-8083.md): CompuLab Intense PC and MintBox 2 devices with BIOS before 2017-05-21 do not use the CloseMnf protection mechanism for write protection of f (no CVSS)
- [CVE-2017-9332](https://cve.now/CVE-2017-9332.md): The smarty\_self function in modules/module\_smarty.php in PivotX 2.3.11 mishandles the URI, allowing XSS via vectors involving quotes in the (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.