Week 38, 2016
19–25 September 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 8.6%
-
Critical 9.8
CVE-2016-6531 Open Dental 16.1 and earlier has a hardcoded MySQL root password, which allows remote attackers to obtain administrative access by leveraging access to intrane…EPSS 2.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2016-6415 The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and PIX befor…EPSS 88%
-
Unscored
CVE-2016-6662 Oracle MySQL through 5.5.52, 5.6.x through 5.6.33, and 5.7.x through 5.7.15; MariaDB before 5.5.51, 10.0.x before 10.0.27, and 10.1.x before 10.1.17; and Perco…EPSS 68%
-
Unscored
CVE-2016-5427 PowerDNS (aka pdns) Authoritative Server before 3.4.10 does not properly handle a . (dot) inside labels, which allows remote attackers to cause a denial of ser…EPSS 63%
-
Unscored
CVE-2016-5426 PowerDNS (aka pdns) Authoritative Server before 3.4.10 allows remote attackers to cause a denial of service (backend CPU consumption) via a long qname.EPSS 31%
-
Unscored
CVE-2015-8921 The ae_strtofflags function in archive_entry.c in libarchive before 3.2.0 allows remote attackers to cause a denial of service (out-of-bounds read) via a craft…EPSS 12%
- High 7.5 EPSS 9.7%
-
Unscored
CVE-2016-6354 Heap-based buffer overflow in the yy_get_next_buffer function in Flex before 2.6.1 might allow context-dependent attackers to cause a denial of service or poss…EPSS 9.1%
-
Unscored
CVE-2016-7163 Integer overflow in the opj_pi_create_decode function in pi.c in OpenJPEG allows remote attackers to execute arbitrary code via a crafted JP2 file, which trigg…EPSS 7.1%
Advisories
- Debian Security (DSA / DLA) 17
- Ubuntu Security Notices (USN) 12
- SUSE / openSUSE Security Updates 8
- CISA ICS & IT advisories 31 critical
- Oracle Linux Security Advisories (ELSA) 31 critical
- BSI CERT-Bund (WID) 1
- ELSA-2016-1912 Critical: firefox security update (Oracle Linux 7) 12 CVEs
- ICSA-16-357-02 WAGO Ethernet Web-based Management Authentication Bypass Vulnerability 1 CVEs