Week 2, 2017
9–15 January 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 97%
- Critical 9.8 EPSS 14%
- Critical 9.8 EPSS 3.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-0004 The Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote atta…EPSS 89%
-
Unscored
CVE-2017-5487 wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php in the REST API implementation in WordPress 4.7 before 4.7.1 does not properly restrict listi…EPSS 87%
-
Unscored
CVE-2016-7434 The read_mru_list function in NTP before 4.2.8p9 allows remote attackers to cause a denial of service (crash) via a crafted mrulist query.EPSS 53%
-
Unscored
CVE-2016-7478 Zend/zend_exceptions.c in PHP, possibly 5.x before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (infinite loop) via a cra…EPSS 42%
-
Unscored
CVE-2016-7479 In all versions of PHP 7, during the unserialization process, resizing the 'properties' hash table of a serialized object may lead to use-after-free. A remote …EPSS 42%
-
Unscored
CVE-2016-7480 The SplObjectStorage unserialize implementation in ext/spl/spl_observer.c in PHP before 7.0.12 does not verify that a key is an object, which allows remote att…EPSS 42%
-
Unscored
CVE-2016-9131 named in ISC BIND 9.x before 9.9.9-P5, 9.10.x before 9.10.4-P5, and 9.11.x before 9.11.0-P2 allows remote attackers to cause a denial of service (assertion fai…EPSS 41%
-
Unscored
CVE-2016-9312 ntpd in NTP before 4.2.8p9, when running on Windows, allows remote attackers to cause a denial of service via a large UDP packet.EPSS 32%
Advisories
- Debian Security (DSA / DLA) 21
- SUSE / openSUSE Security Updates 17
- Ubuntu Security Notices (USN) 8
- CISA ICS & IT advisories 52 critical
- Oracle Linux Security Advisories (ELSA) 4
- BSI CERT-Bund (WID) 4
- ICSA-17-012-03 Carlo Gavazzi VMU-C EM and VMU-C PV 3 CVEs
- ICSA-17-012-01 Advantech WebAccess 2 CVEs