Suse Linux Enterprise Module For Web Scripting vulnerabilities

2 CVEs affecting Suse Linux Enterprise Module For Web Scripting, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-4473, published 2017-06-08.

More from Suse.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2016-4473, published 2017-06-08. Critical severity, CVSS 9.8. EPSS: 7.8% chance of exploitation in the next 30 days. /ext/phar/phar_object.c in PHP 7.0.7 and 5.6.x allows remote attackers to execute arbitrary code. NOTE: Introduced as part of an incomplete fix to CVE-2015-6833.
• CVE-2015-8866, published 2016-05-22. Critical severity, CVSS 9.6. EPSS: 4.2% chance of exploitation in the next 30 days. ext/libxml/libxml.c in PHP before 5.5.22 and 5.6.x before 5.6.6, when PHP-FPM is used, does not isolate each thread from libxml_disable_entity_loader changes in other threads, which allows remote…