Week 47, 2016
21–27 November 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-1248 vim before patch 8.0.0056 does not properly validate values for the 'filetype', 'syntax' and 'keymap' options, which may result in the execution of arbitrary c…EPSS 25%
-
Medium 6.5
CVE-2016-9563 BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~…EPSS 24%
-
Unscored
CVE-2016-6754 A remote code execution vulnerability in Webview in Android 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-11-05 could enable a remote attacker to…EPSS 4.6%
-
Unscored
CVE-2016-6707 An elevation of privilege vulnerability in System Server in Android 6.x before 2016-11-01 and 7.0 before 2016-11-01 could enable a local malicious application …EPSS 4.2%
-
Unscored
CVE-2016-9562 SAP NetWeaver AS JAVA 7.4 allows remote attackers to cause a Denial of Service (null pointer exception and icman outage) via an HTTPS request to the sap.com~P4…EPSS 4%
-
Unscored
CVE-2016-9540 tools/tiffcp.c in libtiff 4.0.6 has an out-of-bounds write on tiled images with odd tile width versus image width. Reported as MSVR 35103, aka "cpStripToTile h…EPSS 3.7%
-
Unscored
CVE-2016-9538 tools/tiffcrop.c in libtiff 4.0.6 reads an undefined buffer in readContigStripsIntoBuffer() because of a uint16 integer overflow. Reported as MSVR 35100.EPSS 3.7%
-
Unscored
CVE-2016-9533 tif_pixarlog.c in libtiff 4.0.6 has out-of-bounds write vulnerabilities in heap allocated buffers. Reported as MSVR 35094, aka "PixarLog horizontalDifference h…EPSS 3.6%
Advisories
- Debian Security (DSA / DLA) 202 critical
- SUSE / openSUSE Security Updates 16
- Ubuntu Security Notices (USN) 6
- Oracle Linux Security Advisories (ELSA) 2
- CISA ICS & IT advisories 22 critical
- BSI CERT-Bund (WID) 1
- Siemens ProductCERT 1
- DSA-3720-1 tomcat8 - security update 5 CVEs
- DSA-3721-1 tomcat7 - security update 5 CVEs
- ICSA-16-049-02A AMX Multiple Products Credential Management Vulnerabilities (Update A) 2 CVEs
- ICSA-16-049-01 B+B SmartWorx VESP211 Authentication Bypass Vulnerability 1 CVEs