Week 19, 2017
8–14 May 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 2.5%
-
Critical 9.1
CVE-2017-8872 The htmlParseTryOrFinish function in HTMLparser.c in libxml2 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.EPSS 2.3%
- Critical 9.8 EPSS 1.7%
- Critical 9.1 EPSS 1.6%
- Critical 9.8 EPSS 1.1%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 7.3
CVE-2017-0213 Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, W…EPSS 84%
-
Unscored
CVE-2017-0290 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, W…EPSS 81%
-
High 7.8
CVE-2017-0262 Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in m…EPSS 81%
-
High 7.8
CVE-2017-0261 Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly handle objects in m…EPSS 78%
-
Unscored
CVE-2017-8895 In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple…EPSS 71%
-
Unscored
CVE-2017-0190 The GDI component in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold…EPSS 43%
-
Unscored
CVE-2016-10329 Command injection vulnerability in login.php in Synology Photo Station before 6.5.3-3226 allows remote attackers to execute arbitrary code via shell metacharac…EPSS 41%
- High 7.5 EPSS 38%
Advisories
- Debian Security (DSA / DLA) 18
- SUSE / openSUSE Security Updates 132 critical
- Ubuntu Security Notices (USN) 7
- CISA ICS & IT advisories 5
- Oracle Linux Security Advisories (ELSA) 4
- BSI CERT-Bund (WID) 1
- Siemens ProductCERT 1
- SUSE-SU-2017:1229-1 Security update for tomcat 3 CVEs
- SUSE-SU-2017:1233-1 Security update for openstack-magnum 1 CVEs