Week 11, 2017
13–19 March 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-3881 A vulnerability in the Cisco Cluster Management Protocol (CMP) processing code in Cisco IOS and Cisco IOS XE Software could allow an unauthenticated, remote at…EPSS 99%
- Critical 9.8 EPSS 7.5%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.5
CVE-2017-0147 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…EPSS 100%
-
High 8.1
CVE-2017-0148 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…EPSS 99%
-
High 8.8
CVE-2017-0144 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…EPSS 99%
-
High 8.8
CVE-2017-0143 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…EPSS 93%
-
High 8.8
CVE-2017-0146 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…EPSS 90%
-
High 8.8
CVE-2017-0145 The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.…EPSS 90%
-
Unscored
CVE-2017-0070 A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. Thes…EPSS 77%
-
Medium 4.3
CVE-2017-0059 Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explo…EPSS 62%
Advisories
- SUSE / openSUSE Security Updates 28
- Debian Security (DSA / DLA) 17
- Ubuntu Security Notices (USN) 81 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 21 critical
- CISA ICS & IT advisories 2
- USN-3235-1 libxml2 vulnerabilities 3 CVEs
- ELSA-2017-0558 Critical: firefox security update (Oracle Linux 7) 1 CVEs