Week 49, 2016
5–11 December 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 5.1%
- Critical 9.8 EPSS 3.2%
- Critical 9.8 EPSS 1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-8740 The mod_http2 module in the Apache HTTP Server 2.4.17 through 2.4.23, when the Protocols configuration includes h2 or h2c, does not restrict request-header len…EPSS 79%
-
High 7.5
CVE-2016-8858 The kex_input_kexinit function in kex.c in OpenSSH 6.x and 7.x through 7.3 allows remote attackers to cause a denial of service (memory consumption) by sending…EPSS 29%
-
High 7.5
CVE-2016-6321 Directory traversal vulnerability in the safer_name_suffix function in GNU tar 1.14 through 1.29 might allow remote attackers to bypass an intended protection …EPSS 16%
-
Unscored
CVE-2016-8655 Race condition in net/packet/af_packet.c in the Linux kernel through 4.8.12 allows local users to gain privileges or cause a denial of service (use-after-free)…EPSS 11%
-
High 7.5
CVE-2016-6301 The recv_and_process_client_pkt function in networking/ntpd.c in busybox allows remote attackers to cause a denial of service (CPU and bandwidth consumption) v…EPSS 9%
- High 8.1 EPSS 6.1%
-
Unscored
CVE-2016-5423 PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 allow remote authenticated users to cause a deni…EPSS 6%
-
Unscored
CVE-2016-9919 The icmp6_send function in net/ipv6/icmp.c in the Linux kernel through 4.8.12 omits a certain check of the dst data structure, which allows remote attackers to…EPSS 5.7%
Advisories
- SUSE / openSUSE Security Updates 262 critical
- Debian Security (DSA / DLA) 12
- Ubuntu Security Notices (USN) 6
- Oracle Linux Security Advisories (ELSA) 4
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 1
- SUSE-SU-2016:3079-1 Security update for tomcat 7 CVEs
- SUSE-SU-2016:3081-1 Security update for tomcat 7 CVEs