Week 51, 2016
19–25 December 2016
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 8.8%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2016-7288 The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit…EPSS 70%
-
Unscored
CVE-2016-7287 The scripting engines in Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memor…EPSS 70%
-
Unscored
CVE-2016-7286 The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit…EPSS 69%
-
High 7.8
CVE-2016-7262 Microsoft Excel 2007 SP3, Excel 2010 SP2, Excel 2013 SP1, Excel 2013 RT SP1, Excel 2016, Office Compatibility Pack SP3, and Excel Viewer allow user-assisted re…EPSS 59%
-
Unscored
CVE-2016-7274 Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Wind…EPSS 40%
-
Unscored
CVE-2016-7272 The Graphics component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows…EPSS 39%
-
Unscored
CVE-2016-7297 The scripting engines in Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web sit…EPSS 27%
-
Unscored
CVE-2016-7289 Microsoft Publisher 2010 SP2 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document, aka "Mi…EPSS 26%
Advisories
- SUSE / openSUSE Security Updates 29
- Debian Security (DSA / DLA) 201 critical
- Ubuntu Security Notices (USN) 6
- Oracle Linux Security Advisories (ELSA) 4
- CISA ICS & IT advisories 2
- BSI CERT-Bund (WID) 2
- DSA-3744-1 libxml2 - security update 2 CVEs