Week 40, 2017
2–8 October 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-12149 In Jboss Application Server as shipped with Red Hat Enterprise Application Platform 5.2, it was found that the doFilter method in the ReadOnlyAccessFilter of t…EPSS 91%
- Critical 9.8 EPSS 6.5%
- Critical 9.8 EPSS 3%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
- High 8.1 EPSS 100%
-
Unscored
CVE-2017-6090 Unrestricted file upload vulnerability in clients/editclient.php in PhpCollab 2.5.1 and earlier allows remote authenticated users to execute arbitrary code by …EPSS 96%
-
Unscored
CVE-2017-14492 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 rou…EPSS 94%
-
Unscored
CVE-2017-14491 Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS resp…EPSS 86%
-
Unscored
CVE-2017-14495 Memory leak in dnsmasq before 2.78, when the --add-mac, --add-cpe-id or --add-subnet option is specified, allows remote attackers to cause a denial of service …EPSS 85%
-
Unscored
CVE-2017-14493 Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 …EPSS 85%
-
Unscored
CVE-2017-1000117 A malicious third-party can give a crafted "ssh://..." URL to an unsuspecting victim, and an attempt to visit the URL can result in any program that exists on …EPSS 78%
-
Unscored
CVE-2017-14494 dnsmasq before 2.78, when configured as a relay, allows remote attackers to obtain sensitive memory information via vectors involving handling DHCPv6 forwarded…EPSS 70%
Advisories
- Debian Security (DSA / DLA) 16
- Ubuntu Security Notices (USN) 111 critical
- SUSE / openSUSE Security Updates 9
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 21 critical
- Oracle Linux Security Advisories (ELSA) 11 critical
- USN-3439-1 ruby1.9.1 vulnerabilities 7 CVEs
- ELSA-2017-2836 Critical: dnsmasq security update (Oracle Linux 7) 6 CVEs
- ICSA-17-278-02 Siemens 7KT PAC1200 Data Manager 1 CVEs