Week 45, 2015
2–8 November 2015
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-7254 Directory traversal vulnerability on Huawei HG532e, HG532n, and HG532s devices allows remote attackers to read arbitrary files via a .. (dot dot) in an icon/ U…EPSS 28%
-
Unscored
CVE-2014-9749 Squid 3.4.4 through 3.4.11 and 3.5.0.1 through 3.5.1, when Digest authentication is used, allow remote authenticated users to retain access by leveraging a sta…EPSS 11%
-
Unscored
CVE-2015-5470 The label decompression functionality in PowerDNS Recursor before 3.6.4 and 3.7.x before 3.7.3 and Authoritative (Auth) Server before 3.3.3 and 3.4.x before 3.…EPSS 11%
-
Unscored
CVE-2015-7182 Heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before …EPSS 10%
-
Unscored
CVE-2015-7696 Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) or possibly execute arbitrary code …EPSS 7.2%
-
Unscored
CVE-2015-7181 The sec_asn1d_parse_leaf function in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1, as used in Firefox before 42.0 and Firef…EPSS 6.9%
-
Unscored
CVE-2015-7183 Integer overflow in the PL_ARENA_ALLOCATE implementation in Netscape Portable Runtime (NSPR) in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.2…EPSS 6.8%
-
Unscored
CVE-2015-7697 Info-ZIP UnZip 6.0 allows remote attackers to cause a denial of service (infinite loop) via empty bzip2 data in a ZIP archive.EPSS 6.1%
Advisories
- Debian Security (DSA / DLA) 10
- Ubuntu Security Notices (USN) 7
- Oracle Linux Security Advisories (ELSA) 52 critical
- CISA ICS & IT advisories 41 critical
- BSI CERT-Bund (WID) 1
- SUSE / openSUSE Security Updates 1
- ELSA-2015-1982 Critical: firefox security update (Oracle Linux 7) 8 CVEs
- ICSA-15-034-02 Siemens Ruggedcom WIN Vulnerability 3 CVEs
- ELSA-2015-1981 Critical: nss, nss-util, and nspr security update (Oracle Linux 7) 3 CVEs