Week 27, 2016
4–10 July 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 17%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-4957 ntpd in NTP before 4.2.8p8 allows remote attackers to cause a denial of service (daemon crash) via a crypto-NAK packet. NOTE: this vulnerability exists because…EPSS 45%
-
Unscored
CVE-2016-6170 ISC BIND through 9.9.9-P1, 9.10.x through 9.10.4-P1, and 9.11.x through 9.11.0b1 allows primary DNS servers to cause a denial of service (secondary DNS server …EPSS 41%
- High 7.5 EPSS 37%
- High 8.2 EPSS 26%
- High 7.5 EPSS 21%
-
Unscored
CVE-2016-4979 The Apache HTTP Server 2.4.18 through 2.4.20, when mod_http2 and mod_ssl are enabled, does not properly recognize the "SSLVerifyClient require" directive for H…EPSS 19%
-
Unscored
CVE-2016-4953 ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (ephemeral-association demobilization) by sending a spoofed crypto-NAK pack…EPSS 17%
-
Unscored
CVE-2016-4956 ntpd in NTP 4.x before 4.2.8p8 allows remote attackers to cause a denial of service (interleaved-mode transition and time change) via a spoofed broadcast packe…EPSS 16%
Advisories
- Debian Security (DSA / DLA) 7
- SUSE / openSUSE Security Updates 7
- Ubuntu Security Notices (USN) 5
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 32 critical
- ICSA-16-278-02 Beckhoff Embedded PC Images and TwinCAT Components Vulnerabilities 2 CVEs
- ICSA-16-278-01 INDAS Web SCADA Path Traversal Vulnerability 1 CVEs