Week 1, 2016
4–10 January 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 38%
- Critical 9.0 EPSS 6.7%
- Critical 10.0 EPSS 3.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2015-5259 Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary co…EPSS 57%
-
Unscored
CVE-2015-4694 Directory traversal vulnerability in download.php in the Zip Attachments plugin before 1.5.1 for WordPress allows remote attackers to read arbitrary files via …EPSS 16%
-
Unscored
CVE-2015-8668 Heap-based buffer overflow in the PackBitsPreEncode function in tif_packbits.c in bmp2tiff in libtiff 4.0.6 and earlier allows remote attackers to execute arbi…EPSS 14%
-
Unscored
CVE-2015-7512 Buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU, when a guest NIC has a larger MTU, allows remote attackers to cause a denial of servic…EPSS 7.7%
-
Unscored
CVE-2015-6639 The Widevine QSEE TrustZone application in Android 5.x before 5.1.1 LMY49F and 6.0 before 2016-01-01 allows attackers to gain privileges via a crafted applicat…EPSS 7%
-
Unscored
CVE-2015-8740 The dissect_tds7_colmetadata_token function in epan/dissectors/packet-tds.c in the TDS dissector in Wireshark 2.0.x before 2.0.1 does not validate the number o…EPSS 6.7%
-
Unscored
CVE-2015-8612 The EnableNetwork method in the Network class in plugins/mechanism/Network.py in Blueman before 2.0.3 allows local users to gain privileges via the dhcp_handle…EPSS 6.3%
-
Unscored
CVE-2014-8886 AVM FRITZ!OS before 6.30 extracts the contents of firmware updates before verifying their cryptographic signature, which allows remote attackers to create syml…EPSS 6.1%
Advisories
- SUSE / openSUSE Security Updates 17
- Debian Security (DSA / DLA) 9
- Ubuntu Security Notices (USN) 91 critical
- Oracle Linux Security Advisories (ELSA) 8
- CISA ICS & IT advisories 11 critical
- BSI CERT-Bund (WID) 1
- ICSA-16-096-01 Pro-face GP-Pro EX HMI Vulnerabilities 4 CVEs
- USN-2862-1 pygments vulnerability 1 CVEs