GNU Guile vulnerabilities

2 CVEs affecting GNU Guile, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-8606, published 2017-01-12.

More from GNU.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-8606, published 2017-01-12. Critical severity, CVSS 9.8. EPSS: 4.2% chance of exploitation in the next 30 days. The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.
• CVE-2016-8605, published 2017-01-12. Medium severity, CVSS 5.3. EPSS: 2.8% chance of exploitation in the next 30 days. The mkdir procedure of GNU Guile temporarily changed the process' umask to zero. During that time window, in a multithreaded application, other threads could end up creating files with insecure…