Week 26, 2017
26 June – 2 July 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 100%
-
Critical 9.8
CVE-2017-7898 An Improper Restriction of Excessive Authentication Attempts issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic contr…EPSS 7%
- Critical 9.8 EPSS 5.6%
-
Critical 9.8
CVE-2017-7903 A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Series A and…EPSS 3.8%
- Critical 9.8 EPSS 2.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-6326 The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to exe…EPSS 73%
-
Unscored
CVE-2017-9445 In systemd through 233, certain sizes passed to dns_packet_new in systemd-resolved can cause it to allocate a buffer that's too small. A malicious DNS server c…EPSS 59%
-
Unscored
CVE-2017-8558 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on 32-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP…EPSS 44%
-
Unscored
CVE-2017-6026 A Use of Insufficiently Random Values issue was discovered in Schneider Electric Modicon PLCs Modicon M241, firmware versions prior to Version 4.0.5.11, and Mo…EPSS 32%
-
Unscored
CVE-2017-9993 FFmpeg before 2.8.12, 3.0.x and 3.1.x before 3.1.9, 3.2.x before 3.2.6, and 3.3.x before 3.3.2 does not properly restrict HTTP Live Streaming filename extensio…EPSS 16%
-
Unscored
CVE-2014-6354 Internet Explorer 6, Internet Explorer 7, Internet Explorer 8, Internet Explorer 9, Internet Explorer 10, and Internet Explorer 11 allows remote attackers to e…EPSS 13%
- Unscored EPSS 11%
-
Unscored
CVE-2017-8797 The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand…EPSS 9.5%
Advisories
- SUSE / openSUSE Security Updates 291 critical
- Debian Security (DSA / DLA) 111 critical
- Oracle Linux Security Advisories (ELSA) 6
- Ubuntu Security Notices (USN) 6
- BSI CERT-Bund (WID) 4
- CISA ICS & IT advisories 43 critical
- ICSA-17-180-02 Schneider Electric U.motion Builder (Update A) 22 CVEs
- DLA-1008-1 libxml2 - security update 5 CVEs
- SUSE-SU-2017:1744-1 Security update for python-pycrypto 1 CVEs
- ICSA-17-180-03 Siemens Viewport for Web Office Portal 1 CVEs
- ICSA-17-180-01A ICSA-17-180-01A_Siemens SIMATIC Industrial PCs, SINUMERIK Panel Control Unit, and SIMOTION P320 (Update A) 1 CVEs