Week 23, 2016
6–12 June 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 93%
-
Critical 9.8
CVE-2016-3087 Apache Struts vulnerable to arbitrary remote code execution due to improper input validationEPSS 82%
- Critical 9.8 EPSS 2.9%
- Critical 9.8 EPSS 2.9%
- Critical 9.8 EPSS 2.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 69%
-
Unscored
CVE-2016-5118 The OpenBlob function in blob.c in GraphicsMagick before 1.3.24 and ImageMagick allows remote attackers to execute arbitrary code via a | (pipe) character at t…EPSS 50%
-
High 7.5
CVE-2016-4523 The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to cause a denial of service (out-of-bounds read …EPSS 31%
-
Unscored
CVE-2016-4532 Directory traversal vulnerability in the WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to read arbi…EPSS 28%
-
Unscored
CVE-2016-5108 Buffer overflow in the DecodeAdpcmImaQT function in modules/codec/adpcm.c in VideoLAN VLC media player before 2.2.4 allows remote attackers to cause a denial o…EPSS 25%
-
Unscored
CVE-2016-4510 The WAP interface in Trihedral VTScada (formerly VTS) 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files…EPSS 20%
-
Unscored
CVE-2016-4450 os/unix/ngx_files.c in nginx before 1.10.1 and 1.11.x before 1.11.1 allows remote attackers to cause a denial of service (NULL pointer dereference and worker p…EPSS 16%
-
Unscored
CVE-2016-4359 Stack-based buffer overflow in mchan.dll in the agent in HPE LoadRunner 11.52 through patch 3, 12.00 through patch 1, 12.01 through patch 3, 12.02 through patc…EPSS 16%
Advisories
- Debian Security (DSA / DLA) 16
- SUSE / openSUSE Security Updates 141 critical
- Ubuntu Security Notices (USN) 12
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 21 critical
- Oracle Linux Security Advisories (ELSA) 21 critical
- ELSA-2016-1217 Critical: firefox security update (Oracle Linux 7) 6 CVEs
- SUSE-SU-2016:1528-1 Security update for openssh 3 CVEs
- ICSA-16-252-01 GE Bently Nevada 3500/22M Improper Authorization Vulnerability 1 CVEs