Week 49, 2017
4–10 December 2017
Newly exploited 0
Added to CISA KEV or flagged as exploited by ENISA this week — patch these first.
No newly exploited vulnerabilities were reported this week.
Critical new vulnerabilities
Published this week with a CVSS score of 9.0 or higher, most likely to be exploited first.
- Critical 9.8 EPSS 6.3%
- Critical 9.8 EPSS 4.6%
Not critical, but likely targeted
New this week with the highest EPSS — a lower CVSS score does not mean nobody will use them.
-
Unscored
CVE-2017-3737 OpenSSL 1.0.2 (starting from version 1.0.2b) introduced an "error state" mechanism. The intent was that if a fatal error occurred during a handshake then OpenS…EPSS 79%
-
Unscored
CVE-2017-15889 Command injection vulnerability in smart.cgi in Synology DiskStation Manager (DSM) before 5.2-5967-5 allows remote authenticated users to execute arbitrary com…EPSS 74%
-
Unscored
CVE-2017-16930 The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based bu…EPSS 34%
-
Unscored
CVE-2017-11937 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1…EPSS 28%
-
Unscored
CVE-2017-11940 The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Windows 7 SP1, Windows 8.1, Windows RT 8.1, Windows 10 Gold, 1…EPSS 21%
-
Unscored
CVE-2017-13156 An elevation of privilege vulnerability in the Android system (art). Product: Android. Versions: 5.1.1, 6.0, 6.0.1, 7.0, 7.1.1, 7.1.2, 8.0. Android ID A-642118…EPSS 20%
-
Unscored
CVE-2017-16921 In OTRS 6.0.x up to and including 6.0.1, OTRS 5.0.x up to and including 5.0.24, and OTRS 4.0.x up to and including 4.0.26, an attacker who is logged into OTRS …EPSS 20%
-
Unscored
CVE-2017-16393 An issue was discovered in Adobe Acrobat and Reader: 2017.012.20098 and earlier versions, 2017.011.30066 and earlier versions, 2015.006.30355 and earlier versi…EPSS 17%
Advisories
- SUSE / openSUSE Security Updates 221 critical
- Debian Security (DSA / DLA) 13
- Ubuntu Security Notices (USN) 10
- Oracle Linux Security Advisories (ELSA) 8
- BSI CERT-Bund (WID) 4
- CISA ICS & IT advisories 31 critical
- CERT@VDE 1
- SUSE-SU-2017:3253-1 Fixing security issues on OBS toolchain 3 CVEs
- ICSA-17-341-01 Xiongmai Technology IP Cameras and DVRs 1 CVEs