Week 21, 2016

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2016-0718 Expat allows context-dependent attackers to cause a denial of service (crash) or possibly execute arbitrary code via a malformed input document, which triggers…
  EPSS 13%
• Unscored
  CVE-2016-4557 The replace_map_fd_with_map_ptr function in kernel/bpf/verifier.c in the Linux kernel before 4.5.5 does not properly maintain an fd data structure, which allow…
  EPSS 10%
• Unscored
  CVE-2016-4001 Buffer overflow in the stellaris_enet_receive function in hw/net/stellaris_enet.c in QEMU, when the Stellaris ethernet controller is configured to accept large…
  EPSS 4.9%
• Unscored
  CVE-2016-4485 The llc_cmsg_rcv function in net/llc/af_llc.c in the Linux kernel before 4.5.5 does not initialize a certain data structure, which allows attackers to obtain s…
  EPSS 4.7%
• Unscored
  CVE-2016-4049 The bgp_dump_routes_func function in bgpd/bgp_dump.c in Quagga does not perform size checks when dumping data, which might allow remote attackers to cause a de…
  EPSS 4.6%
• Unscored
  CVE-2016-3959 Denial of service due to unchecked parameters in crypto/dsa
  EPSS 4.4%
• Unscored
  CVE-2016-4580 The x25_negotiate_facilities function in net/x25/x25_facilities.c in the Linux kernel before 4.5.5 does not properly initialize a certain data structure, which…
  EPSS 4.1%
• Unscored
  CVE-2016-0264 Buffer overflow in the Java Virtual Machine (JVM) in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before…
  EPSS 3.9%