Week 28, 2016
11–17 July 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-3251 The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 201…EPSS 58%
-
Unscored
CVE-2016-3272 The kernel in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandles page-fault system calls, which al…EPSS 43%
-
Unscored
CVE-2016-4232 Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to obtain se…EPSS 36%
- High 8.8 EPSS 35%
-
Unscored
CVE-2016-3238 The Print Spooler service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Wind…EPSS 34%
-
Unscored
CVE-2016-4228 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Lin…EPSS 33%
-
Unscored
CVE-2016-4226 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Lin…EPSS 33%
-
Unscored
CVE-2016-4231 Use-after-free vulnerability in Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Lin…EPSS 33%
Advisories
- Ubuntu Security Notices (USN) 10
- Debian Security (DSA / DLA) 8
- SUSE / openSUSE Security Updates 6
- CISA ICS & IT advisories 63 critical
- BSI CERT-Bund (WID) 1
- Oracle Linux Security Advisories (ELSA) 1
- ICSA-16-287-07A Kabona AB WDC Vulnerabilities (Update A) 4 CVEs
- ICSA-16-287-04 Rockwell Automation Stratix Denial-of-Service and Memory Leak Vulnerabilities 4 CVEs
- ICSA-16-287-02 Siemens Automation License Manager Vulnerabilities 3 CVEs