Week 48, 2017
27 November – 3 December 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
-
Critical 9.8
CVE-2017-8817 The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or …EPSS 11%
-
Critical 9.8
CVE-2017-8816 The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer overflow and resul…EPSS 8.5%
- Critical 9.8 EPSS 6.2%
- Critical 9.8 EPSS 3.6%
- Critical 9.8 EPSS 2.4%
- Critical 9.8 EPSS 1.7%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-17090 An issue was discovered in chan_skinny.c in Asterisk Open Source 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older, and Certified Asterisk 13.13-cert7 …EPSS 82%
-
Unscored
CVE-2017-11283 Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier…EPSS 43%
-
Unscored
CVE-2017-11284 Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier…EPSS 43%
-
Unscored
CVE-2017-13872 An issue was discovered in certain Apple products. macOS High Sierra before Security Update 2017-001 is affected. The issue involves the "Directory Utility" co…EPSS 37%
-
Unscored
CVE-2017-11282 Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution. T…EPSS 34%
-
Unscored
CVE-2017-11281 Adobe Flash Player has an exploitable memory corruption vulnerability in the text handling function. Successful exploitation could lead to arbitrary code execu…EPSS 33%
-
High 7.5
CVE-2017-17058 The WooCommerce plugin through 3.x for WordPress has a Directory Traversal Vulnerability via a /wp-content/plugins/woocommerce/templates/emails/plain/ URI, whi…EPSS 24%
-
Unscored
CVE-2017-15275 Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.EPSS 21%
Advisories
- SUSE / openSUSE Security Updates 56
- Debian Security (DSA / DLA) 112 critical
- Ubuntu Security Notices (USN) 111 critical
- Oracle Linux Security Advisories (ELSA) 6
- BSI CERT-Bund (WID) 3
- CISA ICS & IT advisories 3
- USN-3498-1 curl vulnerabilities 2 CVEs
- DSA-4051-1 curl - security update 2 CVEs
- DLA-1195-1 curl - security update 1 CVEs