Week 7, 2017
13–19 February 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2016-9361 An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort …EPSS 20%
- Critical 9.8 EPSS 9.6%
-
Critical 9.8
CVE-2016-9369 An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort …EPSS 9%
- Critical 9.8 EPSS 4.1%
-
Critical 9.8
CVE-2016-9366 An issue was discovered in Moxa NPort 5110 versions prior to 2.6, NPort 5130/5150 Series versions prior to 3.6, NPort 5200 Series versions prior to 2.8, NPort …EPSS 3.1%
- Critical 9.1 EPSS 2.4%
- Critical 9.8 EPSS 2%
- Critical 9.8 EPSS 1.9%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Medium 5.9
CVE-2016-6210 sshd in OpenSSH before 7.3, when SHA256 or SHA512 are used for user password hashing, uses BLOWFISH hashing on a static password when the username does not exi…EPSS 89%
-
Unscored
CVE-2016-10134 SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQL commands via the toggle_ids array par…EPSS 83%
-
Unscored
CVE-2016-8652 The auth component in Dovecot before 2.2.27, when auth-policy is configured, allows a remote attackers to cause a denial of service (crash) by aborting authent…EPSS 48%
-
Unscored
CVE-2017-2992 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability when parsing an MP4 header. Successful exploitation could le…EPSS 33%
-
Unscored
CVE-2017-2986 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the Flash Video (FLV) codec. Successful exploitation coul…EPSS 31%
-
Unscored
CVE-2017-5972 The TCP stack in the Linux kernel 3.x does not properly implement a SYN cookie protection mechanism for the case of a fast network connection, which allows rem…EPSS 24%
-
Unscored
CVE-2017-2985 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable use after free vulnerability in the ActionScript 3 BitmapData class. Successful exploita…EPSS 22%
-
Unscored
CVE-2017-2984 Adobe Flash Player versions 24.0.0.194 and earlier have an exploitable heap overflow vulnerability in the h264 decoder routine. Successful exploitation could l…EPSS 18%
Advisories
- SUSE / openSUSE Security Updates 16
- Debian Security (DSA / DLA) 14
- Ubuntu Security Notices (USN) 62 critical
- BSI CERT-Bund (WID) 5
- CISA ICS & IT advisories 52 critical
- Oracle Linux Security Advisories (ELSA) 21 critical
- ELSA-2017-0269 Critical: java-1.7.0-openjdk security update (Oracle Linux 7) 11 CVEs
- ICSA-17-045-02 Geutebrück IP Cameras 2 CVEs
- USN-3199-2 Python Crypto regression 1 CVEs
- USN-3199-1 Python Crypto vulnerability 1 CVEs
- ICSA-17-045-03 ICSA-17-045-03 Siemens SIMATIC Authentication Bypass (Update D) 1 CVEs