# CVEs published 2017-06-27

53 CVEs were published on June 27, 2017: 1 critical, 3 high. 1 is now in CISA KEV. Days are UTC.

- [CVE-2004-2778](https://cve.now/CVE-2004-2778.md): Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, which allows local users to read or (no CVSS)
- [CVE-2012-5010](https://cve.now/CVE-2012-5010.md): ASA 5515-X Adaptive Security Appliance Adaptive Security Appliance (ASA) Software 9.4.x before 9.4.1 Interim, 9.2.x before 9.2.4 Interim, AS (no CVSS)
- [CVE-2014-6354](https://cve.now/CVE-2014-6354.md): Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11 allows re (no CVSS)
- [CVE-2014-8149](https://cve.now/CVE-2014-8149.md): OpenDaylight defense4all 1.1.0 and earlier allows remote authenticated users to write report data to arbitrary files. (no CVSS)
- [CVE-2015-1591](https://cve.now/CVE-2015-1591.md): The kamailio build in kamailio before 4.2.0-2 process allows local users to gain privileges. (no CVSS)
- [CVE-2015-1778](https://cve.now/CVE-2015-1778.md): The custom authentication realm used by karaf-tomcat's "opendaylight" realm in Opendaylight before Helium SR3 will authenticate any username (no CVSS, org.opendaylight.odlparent:opendaylight-karaf-resources)
- [CVE-2015-1795](https://cve.now/CVE-2015-1795.md): Red Hat Gluster Storage RPM Package 3.2 allows local users to gain privileges and execute arbitrary code as root. (no CVSS)
- [CVE-2015-2245](https://cve.now/CVE-2015-2245.md): Huawei Ascend P7 allows remote attackers to cause a denial of service (phone process crash). (no CVSS)
- [CVE-2015-3840](https://cve.now/CVE-2015-3840.md): The MessageStatusReceiver service in the AndroidManifest.XML in Android 5.1.1 and earlier allows local users to alter sent/received statuses (no CVSS)
- [CVE-2015-5180](https://cve.now/CVE-2015-5180.md): res\_query in libresolv in glibc before 2.25 allows remote attackers to cause a denial of service (NULL pointer dereference and process crash (no CVSS)
- [CVE-2015-5378](https://cve.now/CVE-2015-5378.md): Logstash 1.5.x before 1.5.3 and 1.4.x before 1.4.4 allows remote attackers to read communications between Logstash Forwarder agent and Logst (no CVSS)
- [CVE-2015-7780](https://cve.now/CVE-2015-7780.md): Directory traversal vulnerability in ManageEngine Firewall Analyzer before 8.0. (no CVSS)
- [CVE-2015-7781](https://cve.now/CVE-2015-7781.md): ManageEngine Firewall Analyzer before 8.0 does not restrict access permissions. (no CVSS)
- [CVE-2015-7895](https://cve.now/CVE-2015-7895.md): Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). (no CVSS)
- [CVE-2015-7898](https://cve.now/CVE-2015-7898.md): Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). (no CVSS)
- [CVE-2015-8697](https://cve.now/CVE-2015-8697.md): stalin 0.11-5 allows local users to write to arbitrary files. (no CVSS)
- [CVE-2016-0959](https://cve.now/CVE-2016-0959.md): Use after free vulnerability in Adobe Flash Player Desktop Runtime before 20.0.0.267, Adobe Flash Player Extended Support Release before 18. (no CVSS)
- [CVE-2016-4383](https://cve.now/CVE-2016-4383.md): The glance-manage db in all versions of HPE Helion Openstack Glance allows deleted image ids to be reassigned, which allows remote authentic (no CVSS)
- [CVE-2016-5414](https://cve.now/CVE-2016-5414.md): FreeIPA 4.4.0 allows remote attackers to request an arbitrary SAN name for services. (no CVSS)
- [CVE-2016-6342](https://cve.now/CVE-2016-6342.md): elog 3.1.1 allows remote attackers to post data as any username in the logbook. (no CVSS)
- [CVE-2016-7062](https://cve.now/CVE-2016-7062.md): rhscon-ceph in Red Hat Storage Console 2 x86\_64 and Red Hat Storage Console Node 2 x86\_64 allows local users to obtain the password as clear (no CVSS)
- [CVE-2017-2491](https://cve.now/CVE-2017-2491.md): Use after free vulnerability in the String.replace method JavaScriptCore in Apple Safari in iOS before 10.3 allows remote attackers to execu (no CVSS)
- [CVE-2017-6086](https://cve.now/CVE-2017-6086.md): Multiple cross-site request forgery (CSRF) vulnerabilities in the addAction and purgeAction functions in ViMbAdmin 3.0.15 allow remote attac (no CVSS, opensolutions/vimbadmin)
- [CVE-2017-9830](https://cve.now/CVE-2017-9830.md): Remote Code Execution is possible in Code42 CrashPlan 5.4.x via the org.apache.commons.ssl.rmi.DateRMI Java class, because (upon instantiati (no CVSS)
- [CVE-2017-9841](https://cve.now/CVE-2017-9841.md): Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP code via HTTP POST da (CVSS 9.8, KEV, phpunit/phpunit)
- [CVE-2016-6083](https://cve.now/CVE-2016-6083.md): IBM Tivoli Monitoring V6 could allow an unauthenticated user to access SOAP queries that could contain sensitive information. (no CVSS, IBM Tivoli Monitoring)
- [CVE-2016-9738](https://cve.now/CVE-2016-9738.md): IBM QRadar 7.2 and 7.3 does not require that users should have strong passwords by default, which makes it easier for attackers to compromis (no CVSS, IBM Security QRadar SIEM)
- [CVE-2016-9972](https://cve.now/CVE-2016-9972.md): IBM QRadar 7.2 and 7.3 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict T (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1105](https://cve.now/CVE-2017-1105.md): IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a buffer overflow that could al (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1234](https://cve.now/CVE-2017-1234.md): IBM QRadar 7.2 and 7.3 is vulnerable to cross-site scripting. (no CVSS, IBM Security QRadar SIEM)
- [CVE-2017-1297](https://cve.now/CVE-2017-1297.md): IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a stack-based buffer overflow, (no CVSS, IBM DB2 for Linux, UNIX and Windows)
- [CVE-2017-1322](https://cve.now/CVE-2017-1322.md): IBM API Connect 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. (no CVSS, IBM API Connect)
- [CVE-2017-1328](https://cve.now/CVE-2017-1328.md): IBM API Connect 5.0.0.0 - 5.0.6.0 could allow a remote attacker to bypass security restrictions of the api, caused by improper handling of s (no CVSS, IBM API Connect)
- [CVE-2017-9982](https://cve.now/CVE-2017-9982.md): TeamSpeak Client 3.0.19 allows remote attackers to cause a denial of service (application crash) via the ᗪ Unicode character followed (no CVSS)
- [CVE-2017-2841](https://cve.now/CVE-2017-2841.md): An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applica (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2842](https://cve.now/CVE-2017-2842.md): In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can a (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-2843](https://cve.now/CVE-2017-2843.md): In the web management interface in Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can a (CVSS 8.8, Foscam Indoor IP Camera C1 Series)
- [CVE-2017-7524](https://cve.now/CVE-2017-7524.md): tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when gene (no CVSS, TPM 2.0 Tools tpm2-tools)
- [CVE-2017-7508](https://cve.now/CVE-2017-7508.md): OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet. (no CVSS, OpenVPN Technologies OpenVPN)
- [CVE-2017-7520](https://cve.now/CVE-2017-7520.md): OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-i (no CVSS, OpenVPN Technologies OpenVPN)
- [CVE-2017-7521](https://cve.now/CVE-2017-7521.md): OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service due to memory exhaustion caused by memory leaks a (no CVSS, OpenVPN Technologies OpenVPN)
- [CVE-2017-7522](https://cve.now/CVE-2017-7522.md): OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service by authenticated remote attacker via sending a certifica (no CVSS, OpenVPN Technologies OpenVPN)
- [CVE-2017-9218](https://cve.now/CVE-2017-9218.md): The mp4ff\_read\_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9219](https://cve.now/CVE-2017-9219.md): The mp4ff\_read\_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9220](https://cve.now/CVE-2017-9220.md): The mp4ff\_read\_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9221](https://cve.now/CVE-2017-9221.md): The mp4ff\_read\_mdhd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9222](https://cve.now/CVE-2017-9222.md): The mp4ff\_parse\_tag function in common/mp4ff/mp4meta.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9223](https://cve.now/CVE-2017-9223.md): The mp4ff\_read\_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9253](https://cve.now/CVE-2017-9253.md): The mp4ff\_read\_stsd function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9254](https://cve.now/CVE-2017-9254.md): The mp4ff\_read\_stts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9255](https://cve.now/CVE-2017-9255.md): The mp4ff\_read\_stsc function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9256](https://cve.now/CVE-2017-9256.md): The mp4ff\_read\_stco function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)
- [CVE-2017-9257](https://cve.now/CVE-2017-9257.md): The mp4ff\_read\_ctts function in common/mp4ff/mp4atom.c in Freeware Advanced Audio Decoder 2 (FAAD2) 2.7 allows remote attackers to cause a d (no CVSS)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2017-06-27
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.