Week 31, 2016
1–7 August 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-6515 The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote atta…EPSS 59%
-
Unscored
CVE-2016-3078 Multiple integer overflows in php_zip.c in the zip extension in PHP before 7.0.6 allow remote attackers to cause a denial of service (heap-based buffer overflo…EPSS 56%
-
Unscored
CVE-2016-2180 The TS_OBJ_print_bio function in crypto/ts/ts_lib.c in the X.509 Public Key Infrastructure Time-Stamp Protocol (TSP) implementation in OpenSSL through 1.0.2h a…EPSS 30%
-
Unscored
CVE-2016-5639 Directory traversal vulnerability in cgi-bin/login.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to read arbitr…EPSS 21%
-
Unscored
CVE-2016-5640 Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute ar…EPSS 18%
-
Unscored
CVE-2016-5771 spl_array.c in the SPL extension in PHP before 5.5.37 and 5.6.x before 5.6.23 improperly interacts with the unserialize implementation and garbage collection, …EPSS 15%
-
Unscored
CVE-2016-5696 net/ipv4/tcp_input.c in the Linux kernel before 4.7 does not properly determine the rate of challenge ACK segments, which makes it easier for remote attackers …EPSS 15%
-
Unscored
CVE-2016-3132 Double free vulnerability in the SplDoublyLinkedList::offsetSet function in ext/spl/spl_dllist.c in PHP 7.x before 7.0.6 allows remote attackers to execute arb…EPSS 12%
Advisories
- Debian Security (DSA / DLA) 15
- SUSE / openSUSE Security Updates 12
- CISA ICS & IT advisories 64 critical
- Oracle Linux Security Advisories (ELSA) 61 critical
- Ubuntu Security Notices (USN) 4
- BSI CERT-Bund (WID) 2
- ELSA-2016-1551 Critical: firefox security update (Oracle Linux 7) 12 CVEs
- ICSA-16-308-01 Moxa OnCell Security Vulnerabilities 2 CVEs
- ICSMA-16-306-01 Smiths Medical CADD-Solis Medication Safety Software Vulnerabilities 2 CVEs
- ICSA-16-306-02 IBHsoftec S7-SoftPLC CPX43 Heap-based Buffer Overflow Vulnerability 1 CVEs
- ICSA-16-306-01 Schneider Electric ConneXium Buffer Overflow Vulnerability 1 CVEs