Week 17, 2016
25 April – 1 May 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 19%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 97%
-
Unscored
CVE-2016-4054 Buffer overflow in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allows remote attackers to execute arbitrary code via crafted Edge Side Includes (ESI) response…EPSS 78%
-
Unscored
CVE-2016-3074 Integer signedness error in GD Graphics Library 2.1.1 (aka libgd or libgd2) allows remote attackers to cause a denial of service (crash) or potentially execute…EPSS 36%
-
Unscored
CVE-2015-5370 Samba 3.x and 4.x before 4.2.11, 4.3.x before 4.3.8, and 4.4.x before 4.4.2 does not properly implement the DCE-RPC layer, which allows remote attackers to per…EPSS 19%
-
Unscored
CVE-2016-4051 Buffer overflow in cachemgr.cgi in Squid 2.x, 3.x before 3.5.17, and 4.x before 4.0.9 might allow remote attackers to cause a denial of service or execute arbi…EPSS 18%
-
Unscored
CVE-2015-8812 drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbi…EPSS 15%
-
Unscored
CVE-2016-4053 Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote attackers to obtain sensitive stack layout information via crafted Edge Side Includes (ESI) responses…EPSS 14%
-
Unscored
CVE-2016-4052 Multiple stack-based buffer overflows in Squid 3.x before 3.5.17 and 4.x before 4.0.9 allow remote HTTP servers to cause a denial of service or execute arbitra…EPSS 13%
Advisories
- Debian Security (DSA / DLA) 121 critical
- SUSE / openSUSE Security Updates 11
- Ubuntu Security Notices (USN) 5
- CISA ICS & IT advisories 31 critical
- Oracle Linux Security Advisories (ELSA) 21 critical
- DSA-3558-1 openjdk-7 - security update 7 CVEs
- ELSA-2016-0695 Critical: firefox security update (Oracle Linux 7) 5 CVEs
- ICSA-16-208-01C Siemens SIMATIC WinCC, PCS 7, and WinCC Runtime Professional Vulnerabilities (Update C) 2 CVEs