CVE-2016-1241

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Tryton 3.x before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allow remote authenticated users to discover user password hashes via unspecified vectors.

Metrics

CVSS 3.0 5.3/10CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-200

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://www.debian.org/security/2016/dsa-3656Third Party Advisory
http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.htmlVendor Advisory
https://bugs.tryton.org/issue5795Issue Tracking
http://www.debian.org/security/2016/dsa-3656Third Party Advisory
http://www.tryton.org/posts/security-release-for-issue5795-and-issue5808.htmlVendor Advisory
https://bugs.tryton.org/issue5795Issue Tracking

Timeline

Published: Sep 7, 2016
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2016

CVE-2016-12424.4file_open in Tryton before 3.2.17, 3.4.x before 3.4.14, 3.6.x before 3.6.12, 3.8.x before 3.8.8, and 4.x before 4.0.4 allows remote authenti CVE-2016-12439.8Stack-based buffer overflow in the extractTree function in unADF allows remote attackers to execute arbitrary code via a long pathname.CVE-2016-12448.8The extractTree function in unADF allows remote attackers to execute arbitrary code via shell metacharacters in a directory name in an adf f CVE-2016-12459.8It was discovered that the zebra daemon in Quagga before 1.0.20161017 suffered from a stack-based buffer overflow when processing IPv6 Neigh CVE-2016-12467.5Buffer overflow in the DBD::mysql module before 4.037 for Perl allows context-dependent attackers to cause a denial of service (crash) via v CVE-2016-12477.8The nginx package before 1.6.2-5+deb8u3 on Debian jessie, the nginx packages before 1.4.6-1ubuntu3.6 on Ubuntu 14.04 LTS, before 1.10.0-0ubu CVE-2016-12487.8vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execu CVE-2016-12495.9The DBD::mysql module before 4.039 for Perl, when using server-side prepared statement support, allows attackers to cause a denial of servic CVE-2016-12518.1There is a vulnerability of type use-after-free affecting DBD::mysql (aka DBD-mysql or the Database Interface (DBI) MySQL driver for Perl) 3 CVE-2016-12525.9The apt package in Debian jessie before 1.0.9.8.4, in Debian unstable before 1.4~beta2, in Ubuntu 14.04 LTS before 1.0.1ubuntu2.17, in Ubunt CVE-2016-12539.8The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allow CVE-2016-12547.5Tor before 0.2.8.12 might allow remote attackers to cause a denial of service (client crash) via a crafted hidden service descriptor.