Week 43, 2017

23–29 October 2017

New CVEs: 330
Critical: 8
High: 14
Newly exploited: 0
Advisories: 46
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2016-5003 Apache XML-RPC vulnerable to Deserialization of Untrusted Data
EPSS 15%
Critical 9.8
CVE-2014-3600 Improper Restriction of XML External Entity Reference in Apache ActiveMQ
EPSS 8.2%
Critical 9.8
CVE-2014-3579 Apache ActiveMQ Apollo XXE Vulnerability
EPSS 4.6%
Critical 9.8
CVE-2017-16228 Dulwich RCE Vulnerability
EPSS 3.8%
Critical 9.8
CVE-2014-3741 Potential Command Injection in printer
EPSS 3.8%
Critical 9.8
CVE-2017-14695 SaltStack Salt Directory traversal vulnerability in minion id validation
EPSS 3.3%
Critical 9.8
CVE-2015-5171 Cloud Foundry Runtime Insufficient Session Expiration vulnerability
EPSS 1.2%
Critical 9.8
CVE-2015-5172 Cloud Foundry Runtime has Weak Password Recovery Mechanism for Forgotten Password
EPSS 1.2%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

High 8.8
CVE-2017-13089 GNU Wget: stack overflow in HTTP protocol handling
GNU · wget

EPSS 80%
Unscored
CVE-2017-15222 Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.
EPSS 60%
Unscored
CVE-2017-13772 Multiple stack-based buffer overflows in TP-Link WR940N WiFi routers with hardware version 4 allow remote authenticated users to execute arbitrary code via the…
EPSS 51%
Unscored
CVE-2017-16227 The aspath_put function in bgpd/bgp_aspath.c in Quagga before 1.2.2 allows remote attackers to cause a denial of service (session drop) via BGP UPDATE messages…
EPSS 46%
High 8.8
CVE-2017-13090 GNU Wget: heap overflow in HTTP protocol handling
GNU · wget

EPSS 37%
High 7.5
CVE-2014-3744 Directory Traversal in st
EPSS 34%
High 8.8
CVE-2017-5070 Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arb…
EPSS 32%
Unscored
CVE-2017-5115 Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Windows allowed a remote attacker to potentially exploit object corruption via a crafted HTML p…
EPSS 26%

Advisories

SUSE-SU-2017:2854-1 Security update for tcpdump 90 CVEs
ICSA-17-299-01 Korenix JetNet 2 CVEs
SUSE-SU-2017:2831-1 Security update for curl 2 CVEs
DSA-4007-1 curl - security update 1 CVEs
DLA-1143-1 curl - security update 1 CVEs
USN-3457-1 curl vulnerability 1 CVEs