Week 51, 2015
14–20 December 2015
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2015-7755 Juniper ScreenOS 6.2.0r15 through 6.2.0r18, 6.3.0r12 before 6.3.0r12b, 6.3.0r13 before 6.3.0r13b, 6.3.0r14 before 6.3.0r14b, 6.3.0r15 before 6.3.0r15b, 6.3.0r1…EPSS 61%
- Critical 9.8 EPSS 24%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-8562 Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent …EPSS 98%
-
Unscored
CVE-2015-8000 db.c in named in ISC BIND 9.x before 9.9.8-P2 and 9.10.x before 9.10.3-P2 allows remote attackers to cause a denial of service (REQUIRE assertion failure and d…EPSS 56%
-
Unscored
CVE-2015-8327 Incomplete blacklist vulnerability in util.c in foomatic-rip in cups-filters 1.0.42 before 1.2.0 and in foomatic-filters in Foomatic 4.0.x allows remote attack…EPSS 11%
- High EPSS 8.5%
-
Unscored
CVE-2015-8357 Directory traversal vulnerability in the bitrix.xscan module before 1.0.4 for Bitrix allows remote authenticated users to rename arbitrary files, and consequen…EPSS 8.4%
-
Unscored
CVE-2015-6401 Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allow remote attackers to bypass an intended authentication requirement and execute unspecified admin…EPSS 7.6%
-
Unscored
CVE-2015-6402 Cross-site scripting (XSS) vulnerability in the management interface on Cisco EPC3928 devices with EDVA 5.5.10, 5.5.11, and 5.7.1 allows remote attackers to in…EPSS 7.2%
-
Unscored
CVE-2015-7497 Heap-based buffer overflow in the xmlDictComputeFastQKey function in dict.c in libxml2 before 2.9.3 allows context-dependent attackers to cause a denial of ser…EPSS 7.2%
Advisories
- SUSE / openSUSE Security Updates 184 critical
- Debian Security (DSA / DLA) 172 critical
- Ubuntu Security Notices (USN) 164 critical
- Oracle Linux Security Advisories (ELSA) 51 critical
- BSI CERT-Bund (WID) 2
- CISA ICS & IT advisories 22 critical
- Schneider Electric CPCERT 1
- SUSE-SU-2015:2324-1 Security update for xen 14 CVEs
- SUSE-SU-2015:2328-1 Security update for xen 13 CVEs
- SUSE-SU-2015:2326-1 Security update for xen 12 CVEs
- SUSE-SU-2015:2306-1 Security update for xen 10 CVEs
- ELSA-2015-2657 Critical: firefox security update (Oracle Linux 7) 7 CVEs
- USN-2843-2 linux-lts-wily vulnerabilities 5 CVEs
- USN-2842-2 linux-lts-vivid vulnerabilities 4 CVEs
- DSA-3426-1 linux - security update 4 CVEs
- USN-2844-1 linux-lts-utopic vulnerabilities 3 CVEs
- USN-2841-1 linux vulnerabilities 3 CVEs