Week 7, 2016
15–21 February 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 7.5 EPSS 96%
-
Unscored
CVE-2015-7547 Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.…EPSS 92%
-
Unscored
CVE-2016-0701 The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH)…EPSS 84%
-
Unscored
CVE-2016-0742 The resolver in nginx before 1.8.1 and 1.9.x before 1.9.10 allows remote attackers to cause a denial of service (invalid pointer dereference and worker process…EPSS 82%
-
Medium 5.3
CVE-2016-2388 The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka …EPSS 52%
-
Unscored
CVE-2016-2389 Directory traversal vulnerability in the GetFileList function in the SAP Manufacturing Integration and Intelligence (xMII) component 15.0 for SAP NetWeaver 7.4…EPSS 41%
-
Unscored
CVE-2016-0069 Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of …EPSS 19%
-
Unscored
CVE-2016-0068 Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Internet Explorer Elevation of …EPSS 15%
Advisories
- Debian Security (DSA / DLA) 17
- SUSE / openSUSE Security Updates 12
- Ubuntu Security Notices (USN) 11
- Oracle Linux Security Advisories (ELSA) 82 critical
- CISA ICS & IT advisories 3
- BSI CERT-Bund (WID) 1
- ELSA-2016-0197 Critical: firefox security update (Oracle Linux 7) 3 CVEs
- ELSA-2016-0176 Critical: glibc security and bug fix update (Oracle Linux 7) 2 CVEs