Week 22, 2016
30 May – 5 June 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 98%
-
Critical 9.1
CVE-2016-4432 AMQP 0-8, 0-9, 0-91, and 0-10 connection handling in Apache Qpid Java before 6.0.3 might allow remote attackers to bypass authenticationEPSS 8.9%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- Medium 5.9 EPSS 7.8%
-
Unscored
CVE-2016-3075 Stack-based buffer overflow in the nss_dns implementation of the getnetbyname function in GNU C Library (aka glibc) before 2.24 allows context-dependent attack…EPSS 7.3%
-
Unscored
CVE-2016-1999 The server in HP Release Control 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to th…EPSS 6.3%
-
Unscored
CVE-2016-0376 The com.ibm.rmi.io.SunSerializableFactory class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before S…EPSS 5.7%
-
Unscored
CVE-2016-1234 Stack-based buffer overflow in the glob implementation in GNU C Library (aka glibc) before 2.24, when GLOB_ALTDIRFUNC is used, allows context-dependent attacke…EPSS 5.4%
-
Unscored
CVE-2016-0363 The com.ibm.CORBA.iiop.ClientDelegate class in IBM SDK, Java Technology Edition 6 before SR16 FP25 (6.0.16.25), 6 R1 before SR8 FP25 (6.1.8.25), 7 before SR9 F…EPSS 4%
- High 7.8 EPSS 3.8%
-
Unscored
CVE-2016-2025 HPE Service Manager 9.30, 9.31, 9.32, 9.33, 9.34, 9.35, 9.40, and 9.41 allows remote attackers to obtain sensitive information via unspecified vectors, related…EPSS 3.5%
Advisories
- Debian Security (DSA / DLA) 18
- SUSE / openSUSE Security Updates 132 critical
- Ubuntu Security Notices (USN) 6
- Oracle Linux Security Advisories (ELSA) 2
- SUSE-SU-2016:1475-1 Security update for java-1_8_0-ibm 10 CVEs
- SUSE-SU-2016:1458-1 Security update for java-1_6_0-ibm 10 CVEs