Week 47, 2015
16–22 November 2015
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2015-4852 The WLS Security component in Oracle WebLogic Server 10.3.6.0, 12.1.2.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to execute arbitrary commands via a cra…EPSS 95%
-
Critical 10.0
CVE-2015-8104 The KVM subsystem in the Linux kernel through 4.2.6, and Xen 4.3.x through 4.6.x, allows guest OS users to cause a denial of service (host OS panic or hang) by…EPSS 2.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-5311 PowerDNS (aka pdns) Authoritative Server 3.4.4 before 3.4.7 allows remote attackers to cause a denial of service (assertion failure and server crash) via craft…EPSS 67%
-
Unscored
CVE-2015-7036 The fts3_tokenizer function in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allows remote attackers to execute arbitrary code or cause a de…EPSS 39%
-
Unscored
CVE-2015-7805 Heap-based buffer overflow in libsndfile 1.0.25 allows remote attackers to have unspecified impact via the headindex value in the header in an AIFF file.EPSS 14%
-
Unscored
CVE-2015-7897 The media scanning functionality in the face recognition library in android.media.process in Samsung Galaxy S6 Edge before G925VVRU4B0G9 allows remote attacker…EPSS 7%
- Medium EPSS 5.7%
-
Unscored
CVE-2015-0272 GNOME NetworkManager allows remote attackers to cause a denial of service (IPv6 traffic disruption) via a crafted MTU value in an IPv6 Router Advertisement (RA…EPSS 4.9%
-
Unscored
CVE-2015-8220 Stack-based buffer overflow in the URI handler in DWRCC.exe in SolarWinds DameWare Mini Remote Control before 12.0 HotFix 1 allows remote attackers to execute …EPSS 4.8%
-
Unscored
CVE-2015-5255 Adobe BlazeDS, as used in ColdFusion 10 before Update 18 and 11 before Update 7 and LiveCycle Data Services 3.0.x before 3.0.0.354175, 3.1.x before 3.1.0.35418…EPSS 4.5%