Week 39, 2016
26 September – 2 October 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 3.2%
- Critical 9.6
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-2776 buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remot…EPSS 89%
-
Unscored
CVE-2016-6309 statem/statem.c in OpenSSL 1.1.0a does not consider memory-block movement after a realloc call, which allows remote attackers to cause a denial of service (use…EPSS 70%
-
Unscored
CVE-2016-6304 Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (m…EPSS 63%
-
Unscored
CVE-2016-6306 The certificate parser in OpenSSL before 1.0.1u and 1.0.2 before 1.0.2i might allow remote attackers to cause a denial of service (out-of-bounds read) via craf…EPSS 42%
-
Unscored
CVE-2016-7052 crypto/x509/x509_vfy.c in OpenSSL 1.0.2i allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) by triggering a …EPSS 29%
- High 8.1 EPSS 29%
-
Unscored
CVE-2016-6305 The ssl3_read_bytes function in record/rec_layer_s3.c in OpenSSL 1.1.0 before 1.1.0a allows remote attackers to cause a denial of service (infinite loop) by tr…EPSS 16%
-
Unscored
CVE-2016-6307 The state-machine implementation in OpenSSL 1.1.0 before 1.1.0a allocates memory before checking for an excessive length, which might allow remote attackers to…EPSS 14%
Advisories
- SUSE / openSUSE Security Updates 171 critical
- Debian Security (DSA / DLA) 12
- Ubuntu Security Notices (USN) 7
- Oracle Linux Security Advisories (ELSA) 3
- BSI CERT-Bund (WID) 1
- SUSE-SU-2016:2388-1 Security update for openssh 5 CVEs