Week 18, 2016
2–8 May 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.4
CVE-2016-3714 The (1) EPHEMERAL, (2) HTTPS, (3) MVG, (4) MSL, (5) TEXT, (6) SHOW, (7) WIN, and (8) PLT coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow rem…EPSS 97%
-
Unscored
CVE-2016-2107 The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows rem…EPSS 89%
-
Unscored
CVE-2016-2108 The ASN.1 implementation in OpenSSL before 1.0.1o and 1.0.2 before 1.0.2c allows remote attackers to execute arbitrary code or cause a denial of service (buffe…EPSS 78%
-
Medium 5.5
CVE-2016-3718 The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (SSRF) atta…EPSS 76%
-
Medium 5.5
CVE-2016-3715 The EPHEMERAL coder in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allows remote attackers to delete arbitrary files via a crafted image.EPSS 75%
-
Unscored
CVE-2016-2105 Integer overflow in the EVP_EncodeUpdate function in crypto/evp/encode.c in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attackers to cause a de…EPSS 40%
-
Unscored
CVE-2016-4008 The _asn1_extract_der_octet function in lib/decoding.c in GNU Libtasn1 before 4.8, when used without the ASN1_DECODE_FLAG_STRICT_DER flag, allows remote attack…EPSS 29%
-
Unscored
CVE-2016-2109 The asn1_d2i_read_bio function in crypto/asn1/a_d2i_fp.c in the ASN.1 BIO implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h allows remote attacke…EPSS 29%
Advisories
- Debian Security (DSA / DLA) 191 critical
- SUSE / openSUSE Security Updates 162 critical
- Ubuntu Security Notices (USN) 132 critical
- Oracle Linux Security Advisories (ELSA) 3
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 21 critical
- DLA-451-1 openjdk-7 - security update 7 CVEs
- SUSE-SU-2016:1248-1 Security update for java-1_8_0-openjdk 6 CVEs
- USN-2963-1 openjdk-8 vulnerabilities 6 CVEs
- SUSE-SU-2016:1250-1 Security update for java-1_7_0-openjdk 5 CVEs
- USN-2964-1 openjdk-7 vulnerabilities 5 CVEs
- ICSA-16-215-01 Moxa SoftCMS SQL Injection Vulnerability 1 CVEs