Week 5, 2016
1–7 February 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2015-5344 Camel-xstream component in Apache Camel can allow remote attackers to execute arbitrary commandsEPSS 7.1%
- Critical 9.8 EPSS 4.8%
- Critical 10.0 EPSS 3%
-
Critical 10.0
CVE-2016-1505 Radicale is vulnerable to directory traversal on Windows Filesystem Storage Backend componentEPSS 2.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-0801 The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbi…EPSS 33%
-
Unscored
CVE-2016-0861 General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to execute arbitrary commands…EPSS 14%
-
Unscored
CVE-2016-0862 General Electric (GE) Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext…EPSS 9.9%
-
Unscored
CVE-2016-1723 WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru…EPSS 4.4%
-
Unscored
CVE-2016-1725 WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru…EPSS 4.4%
-
Unscored
CVE-2016-1726 WebKit, as used in Apple iOS before 9.2.1 and Safari before 9.0.3, allows remote attackers to execute arbitrary code or cause a denial of service (memory corru…EPSS 4.4%
-
Unscored
CVE-2016-1727 WebKit, as used in Apple iOS before 9.2.1, Safari before 9.0.3, and tvOS before 9.1.1, allows remote attackers to execute arbitrary code or cause a denial of s…EPSS 4.4%
-
Unscored
CVE-2016-1284 rdataset.c in ISC BIND 9 Supported Preview Edition 9.9.8-S before 9.9.8-S5, when nxdomain-redirect is enabled, allows remote attackers to cause a denial of ser…EPSS 3.4%
Advisories
- SUSE / openSUSE Security Updates 171 critical
- Debian Security (DSA / DLA) 7
- Oracle Linux Security Advisories (ELSA) 7
- Ubuntu Security Notices (USN) 6
- CISA ICS & IT advisories 1
- SUSE-SU-2016:0354-1 Security update for the Linux Kernel 9 CVEs