Week 44, 2017

30 October – 5 November 2017

New CVEs: 187
Critical: 5
High: 8
Newly exploited: 0
Advisories: 47
Malicious pkgs: 0

Newly exploited 0

Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.

No newly exploited vulnerabilities were reported this week.

Critical new vulnerabilities

Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.

Critical 9.8
CVE-2017-11767 ChakraCore vulnerable to privilege escalation
Microsoft · ChakraCore

EPSS 9.5%
Critical 9.1
CVE-2017-1000257 An IMAP FETCH response line indicates the size of the returned data, in number of bytes. When that response says the data is zero bytes, libcurl would pass on …
EPSS 6.2%
Critical 9.8
CVE-2013-4366 Hostname verification in Apache HttpClient 4.3 was disabled by default
EPSS 3.3%
Critical 9.8
CVE-2017-1000245 Jenkins SSH Plugin user passwords for encrypted SSH keys stored in plaintext
EPSS 1.4%
Critical 9.8
CVE-2012-4449 Use of a Broken or Risky Cryptographic Algorithm in Apache Hadoop
EPSS 1.2%

Not critical, but likely targeted

New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.

Advisories