Week 36, 2016

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

• Unscored
  CVE-2016-6855 Eye of GNOME (aka eog) 3.16.5, 3.17.x, 3.18.x before 3.18.3, 3.19.x, and 3.20.x before 3.20.4, when used with glib before 2.44.1, allow remote attackers to cau…
  EPSS 18%
• Unscored
  CVE-2016-7152 The HTTPS protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote atta…
  EPSS 13%
• Unscored
  CVE-2016-7153 The HTTP/2 protocol does not consider the role of the TCP congestion window in providing information about content length, which makes it easier for remote att…
  EPSS 13%
• Unscored
  CVE-2016-3861 LibUtils in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-09-01, and 7.0 before 2016-09-01 mishandles conversions between U…
  EPSS 8.3%
• Unscored
  CVE-2015-8948 idn in GNU libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bou…
  EPSS 6.8%
• Unscored
  CVE-2016-6262 idn in libidn before 1.33 might allow remote attackers to obtain sensitive memory information by reading a zero byte as input, which triggers an out-of-bounds …
  EPSS 6.5%
• High 7.5
  CVE-2016-6346 Denial of service in JBoss resteasy
  EPSS 5.6%
• Unscored
  CVE-2016-5157 Heap-based buffer overflow in the opj_dwt_interleave_v function in dwt.c in OpenJPEG, as used in PDFium in Google Chrome before 53.0.2785.89 on Windows and OS …
  EPSS 4.7%