Week 24, 2017
12–18 June 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-8543 Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1…EPSS 74%
-
Critical 9.8
CVE-2017-7676 Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '' wildcard characterEPSS 4.2%
-
Critical 10.0
CVE-2017-7876 This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application. QNAP have already fixed the issue in QTS…EPSS 3.4%
- Critical 9.8 EPSS 1.2%
- Critical 9.8 EPSS 1.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
High 8.8
CVE-2017-8464 Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows …EPSS 90%
-
Unscored
CVE-2017-8548 Microsoft Edge in Microsoft Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an attacker to obtain information to further compromise the u…EPSS 68%
-
Unscored
CVE-2017-8487 Windows OLE in Windows XP and Windows Server 2003 allows an attacker to execute code when a victim opens a specially crafted file or program aka "Windows olecn…EPSS 52%
-
Unscored
CVE-2017-8496 Microsoft Edge in Windows 10 1607 and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user when Microsoft Edge i…EPSS 51%
-
Unscored
CVE-2017-0215 Microsoft Windows 10 1607 and Windows Server 2016 allow an attacker to exploit a security feature bypass vulnerability in Device Guard that could allow the att…EPSS 40%
-
Unscored
CVE-2017-0283 Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Wind…EPSS 39%
-
Unscored
CVE-2017-0292 Windows PDF in Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows remote code exec…EPSS 24%
-
Unscored
CVE-2017-8506 A remote code execution vulnerability exists in Microsoft Office when the software fails to properly handle objects in memory, aka "Office Remote Code Executio…EPSS 24%
Advisories
- Debian Security (DSA / DLA) 171 critical
- SUSE / openSUSE Security Updates 15
- Ubuntu Security Notices (USN) 5
- CISA ICS & IT advisories 4
- BSI CERT-Bund (WID) 2
- Oracle Linux Security Advisories (ELSA) 21 critical
- ELSA-2017-1440 Critical: firefox security update (Oracle Linux 7) 19 CVEs
- DLA-989-1 jython - security update 1 CVEs