Weekly Vulnerabilities Reports > July 13 to 19, 2015

Overview

8 new vulnerabilities reported during this period, including 3 critical vulnerabilities and 4 high severity vulnerabilities. This weekly summary report vulnerabilities in 43 products from 9 vendors including Microsoft, Opensuse, Redhat, Suse, and Adobe. Vulnerabilities are notably categorized as "Out-of-bounds Write", "Use After Free", and "Cross-site Scripting".

  • 7 reported vulnerabilities are remotely exploitables.
  • 2 reported vulnerabilities have public exploit available.
  • 1 reported vulnerabilities are related to weaknesses in OWASP Top Ten.
  • 6 reported vulnerabilities are exploitable by an anonymous user.
  • Microsoft has the most reported vulnerabilities, with 4 reported vulnerabilities.
  • Opensuse has the most reported critical vulnerabilities, with 3 reported vulnerabilities.

TOTAL
VULNERABILITIES
CRITICAL RISK
VULNERABILITIES
HIGH RISK
VULNERABILITIES
MEDIUM RISK
VULNERABILITIES
LOW RISK
VULNERABILITIES
REMOTELY
EXPLOITABLE
LOCALLY
EXPLOITABLE
EXPLOIT
AVAILABLE
EXPLOITABLE
ANONYMOUSLY
AFFECTING
WEB APPLICATION

Vulnerability Details

The following table list reported vulnerabilities for the period covered by this report:

Expand/Hide

3 Critical Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2015-07-16 CVE-2015-2590 Oracle
Canonical
Debian
Suse
Opensuse
Redhat 		Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Libraries, a different vulnerability than CVE-2015-4732.
9.8
2015-07-14 CVE-2015-5123 Redhat
Suse
Opensuse
Adobe 		Use After Free vulnerability in multiple products

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.
9.8
2015-07-14 CVE-2015-5122 Adobe
Redhat
Suse
Opensuse 		Use After Free vulnerability in multiple products

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows and OS X, 11.x through 11.2.202.481 on Linux, and 12.x through 18.0.0.204 on Linux Chrome installations allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that leverages improper handling of the opaqueBackground property, as exploited in the wild in July 2015.
9.8

4 High Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2015-07-14 CVE-2015-2425 Microsoft Out-of-bounds Write vulnerability in Microsoft Internet Explorer 11

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.
8.8
2015-07-14 CVE-2015-2424 Microsoft Out-of-bounds Write vulnerability in Microsoft products

Microsoft PowerPoint 2007 SP3, Word 2007 SP3, PowerPoint 2010 SP2, Word 2010 SP2, PowerPoint 2013 SP1, Word 2013 SP1, and PowerPoint 2013 RT SP1 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document, aka "Microsoft Office Memory Corruption Vulnerability."
8.8
2015-07-14 CVE-2015-2419 Microsoft Out-of-bounds Write vulnerability in Microsoft Internet Explorer 10/11

JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "JScript9 Memory Corruption Vulnerability."
8.8
2015-07-14 CVE-2015-2387 Microsoft Out-of-bounds Write vulnerability in Microsoft products

ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "ATMFD.DLL Memory Corruption Vulnerability."
7.8

1 Medium Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS
2015-07-14 CVE-2015-5521 Blackcat CMS Cross-site Scripting vulnerability in Blackcat-Cms Blackcat CMS 1.1.2

Cross-site scripting (XSS) vulnerability in BlackCat CMS 1.1.2 allows remote attackers to inject arbitrary web script or HTML via the name in a new group to backend/groups/index.php.
4.8

0 Low Vulnerabilities

DATE CVE VENDOR VULNERABILITY CVSS