Week 27, 2017
3–9 July 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-9248 Telerik.Web.UI.dll in Progress Telerik UI for ASP.NET AJAX before R2 2017 SP1 and Sitefinity before 10.0.6412.0 does not properly protect Telerik.Web.UI.Dialog…EPSS 75%
- Critical 9.8 EPSS 6.2%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-10974 Yaws 1.91 allows Unauthenticated Remote File Disclosure via HTTP Directory Traversal with /%5C../ to port 8080. NOTE: this CVE is only about use of an initial …EPSS 81%
-
Unscored
CVE-2017-9629 A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. The stack-based buffe…EPSS 9.8%
-
Unscored
CVE-2017-10989 The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted data…EPSS 8.6%
- High 7.5 EPSS 5.6%
-
Unscored
CVE-2015-3297 Directory traversal vulnerability in node/utils/Minify.js in Etherpad 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by leveraging replace…EPSS 5%
-
Unscored
CVE-2017-10994 Foxit Reader before 8.3.1 and PhantomPDF before 8.3.1 have an Arbitrary Write vulnerability, which allows remote attackers to execute arbitrary code via a craf…EPSS 4.9%
-
Unscored
CVE-2017-11108 tcpdump 4.9.0 allows remote attackers to cause a denial of service (heap-based buffer over-read and application crash) via crafted packet data. The crash occur…EPSS 4.9%
-
Unscored
CVE-2017-8116 The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands …EPSS 4.5%
Advisories
- SUSE / openSUSE Security Updates 231 critical
- Debian Security (DSA / DLA) 16
- Ubuntu Security Notices (USN) 5
- CISA ICS & IT advisories 51 critical
- BSI CERT-Bund (WID) 3
- Oracle Linux Security Advisories (ELSA) 2
- SUSE-SU-2017:1813-1 Security update for libxml2 4 CVEs
- ICSA-17-187-04 Schneider Electric Wonderware ArchestrA Logger 3 CVEs