An use-after-free flaw was found in the libxml component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=623378

External References:

https://googlechromereleases.blogspot.com/2016/07/stable-channel-update.html

Google Chromium V8 Engine contains an out-of-bounds read vulnerability that allows a remote attacker to cause a denial of service or possibly have another unspecified impact via crafted JavaScript code. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

inftrees.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact by leveraging improper pointer arithmetic

Last updated 11 July 2025

It was discovered that the upstream fix for this issue was not complete. There is still a memory allocation failure in memory.c

References:

http://seclists.org/oss-sec/2016/q4/197 https://blogs.gentoo.org/ago/2016/10/20/imagemagick-memory-allocation-failure-in-acquiremagickmemory-memory-c-incomplete-fix-for-cve-2016-8862/

Multiple unspecified vulnerabilities in Google Chrome before 51.0.2704.63 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A cross-origin bypass flaw was found in the extension bindings component of the Chromium browser.

Upstream bug(s):

https://code.google.com/p/chromium/issues/detail?id=590118

External References:

http://googlechromereleases.blogspot.com/2016/05/stable-channel-update25.html

named in ISC BIND 9.x before 9.9.8-P4 and 9.10.x before 9.10.3-P4 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted signature record for a DNAME record, related to db.c and resolver.c.

A vulnerability was found in ImageMagick. Insufficient filtering for filename passed to delegate's command allows remote code execution during conversion of several file formats.

ImageMagick allows to process files with external libraries. This feature is called 'delegate'. It is implemented as a system() with command string ('command') from the config file delegates.xml with actual value for different params (input/output filenames etc). Due to insufficient %M param filtering it is possible to conduct shell command injection. One of the default delegate's command is used to handle https requests:

"wget" -q -O "%o" "https:%M"

where %M is the actual link from the input. It is possible to pass the value like https://example.com"|ls "-la and execute unexpected 'ls -la'. (wget or curl should be installed).

A use-after-free vulnerability in libcurl was found. libcurl works with easy handles using the type 'CURL ' that are objects the application creates using curleasyinit(). They are the handles that are all each associated with a single transfer at a time. libcurl also has an internal struct that represents and holds most state that is related to a single connection. An easy handle can hold references to one or many such connection structs depending on the requested operations.

When using libcurl's multi interface, an application performs transfers by adding one or more easy handles to the multi handle and then it can drive all those transfers in parallel.

Due to a flaw, libcurl could leave a pointer to a freed connection struct dangling in an easy handle that was previously added to a multi handle when curlmulticleanup() is called with an easy handle still added to it. This does not seem to cause any notable harm if the handle is then closed properly.

However, if the easy handle would instead get used again with the easy interface and curleasyperform() to do another transfer, it would blindly use the connection struct pointer now pointing to freed memory.

An application could be made to allocate its own fake version of the connect struct, fill in some data and then have the curleasyperform() call do something that clearly was not intended by the original code.

External Reference:

https://curl.haxx.se/docs/adv20160803C.html

apache. Multiple issues existed in Apache. These were addressed by updating Apache to version 2.4.25.

Incorrect emulation of the SPC700 audio co-processor of the Super Nintendo Entertainment System allows the execution of arbitrary code if a malformed SPC music file is opened.

References:

http://scarybeastsecurity.blogspot.cz/2016/12/redux-compromising-linux-using-snes.html http://seclists.org/oss-sec/2016/q4/682

CVE assignments:

http://seclists.org/oss-sec/2016/q4/692

A buffer overflow vulnerability was found in ImageMagick in tiff.c file. A maliciously crafted file could cause the application to crash or possibly have other unspecified impact.

References:

http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=845202

Upstream patch:

https://github.com/ImageMagick/ImageMagick/commit/f8877abac8e568b2f339cca70c2c3c1b6eaec288

game-music-emu before 0.6.1 allows remote attackers to generate out of bounds 8-bit values.

game-music-emu before 0.6.1 allows remote attackers to write to arbitrary memory locations.

An out of bounds read vulnerability was found in ImageMagick. A maliciously crafted file could cause the application to crash or have other unspecified impact.

Upstream bug:

https://github.com/ImageMagick/ImageMagick/issues/129

References:

http://seclists.org/oss-sec/2016/q4/758

Upstream patch:

https://github.com/ImageMagick/ImageMagick/commit/134463b926fa965571aa4febd61b810be5e7da05

The Utah RLE reader in GraphicsMagick before 1.3.25 allows remote attackers to cause a denial of service (CPU consumption or large memory allocations) via vectors involving the header information and the file size.

curl and libcurl before 7.50.1 do not prevent TLS session resumption when the client certificate has changed, which allows remote attackers to bypass intended restrictions by resuming a session.

curl and libcurl before 7.50.1 do not check the client certificate when choosing the TLS connection to reuse, which might allow remote attackers to hijack the authentication of the connection by leveraging a previously created connection with a different client certificate.

After testing original CVE-2016-5420 patch, it was discovered that libcurl built on top of NSS (Network Security Services) still incorrectly re-uses client certificates if a certificate from file is used for one TLS connection but no certificate is set for a subsequent TLS connection.

The original patch for CVE-2016-5420 has been amended to also contain the attached patch:

https://curl.haxx.se/CVE-2016-5420.patch

A vulnerability was found in gnutls. There was an insufficient error checking in the stream reading functions. While parsing a maliciously crafted OpenPGP certificate an out of memory error could occur.

References:

http://seclists.org/oss-sec/2017/q1/51 https://gnutls.org/security.html#GNUTLS-SA-2017-2

Upstream patch:

https://gitlab.com/gnutls/gnutls/commit/49be4f7b82eba2363bb8d4090950dad976a77a3a

Directory traversal vulnerability in Action View in Ruby on Rails allows remote attackers to read arbitrary files.

The Verify function in crypto/dsa/dsa.go in Go before 1.5.4 and 1.6.x before 1.6.1 does not properly check parameters passed to the big integer library, which might allow remote attackers to cause a denial of service (infinite loop) via a crafted public key to a program that uses HTTPS client certificates or SSH server libraries.

A vulnerability was found in tigerVNC. The Xvnc server from tigervnc can crash when a client terminates a TLS connection early. This is due to invalid initialization/deinitialization order of the GnuTLS library.

References:

http://seclists.org/oss-sec/2017/q1/297

Upstream patch:

https://github.com/TigerVNC/tigervnc/commit/8aa4bc53206c2430bbf0c8f4b642f59a379ee649

Libass released a new 0.13.4 version which fixes multiple issues. CVE-2016-7971 remains unfixed for now.

CVE-2016-7969 upstream patch:

https://github.com/libass/libass/pull/240/commits/b72b283b936a600c730e00875d7d067bded3fc26

CVE-2016-7970 upstream patch:

https://github.com/libass/libass/pull/240/commits/08e754612019ed84d1db0d1fc4f5798248decd75

CVE-2016-7972 upstream patch:

https://github.com/libass/libass/pull/240/commits/aa54e0b59200a994d50a346b5d7ac818ebcf2d4b

External References:

https://github.com/libass/libass/releases/tag/0.13.4

Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.

Last updated 25 August 2025

print-wb.c in tcpdump before 4.7.4 allows remote attackers to cause a denial of service (segmentation fault and process crash).

A path traversal vulnerability was found in ImageMagick. An arbitrary module could be loaded into ImageMagick.

References:

http://seclists.org/oss-sec/2016/q4/758 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=833735

Upstream patch:

https://github.com/ImageMagick/ImageMagick/commit/fc6080f1321fd21e86ef916195cc110b05d9effb

coders/tiff.c in ImageMagick allows remote attackers to cause a denial of service (application crash) via vectors related to the "identification of image."