Citrix Provisioning Services vulnerabilities

6 CVEs affecting Citrix Provisioning Services, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2016-9680, published 2017-01-18.

More from Citrix.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2012-4068, published 2012-07-26. High severity, CVSS 7.5. EPSS: 4.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in the SoapServer service in Citrix Provisioning Services 5.0, 5.1, 5.6, 5.6 SP1, 6.0, and 6.1 allows remote attackers to execute arbitrary code via a crafted string…
• CVE-2016-9676, published 2017-01-18. Critical severity, CVSS 9.8. EPSS: 4.1% chance of exploitation in the next 30 days. Buffer overflow in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors.
• CVE-2016-9679, published 2017-01-18. Critical severity, CVSS 9.8. EPSS: 3.2% chance of exploitation in the next 30 days. Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer.
• CVE-2016-9678, published 2017-01-18. Critical severity, CVSS 9.8. EPSS: 3.1% chance of exploitation in the next 30 days. Use-after-free vulnerability in Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code via unspecified vectors.
• CVE-2016-9680, published 2017-01-18. High severity, CVSS 7.5. EPSS: 1.9% chance of exploitation in the next 30 days. Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive information from kernel memory via unspecified vectors.
• CVE-2016-9677, published 2017-01-18. Medium severity, CVSS 5.3. EPSS: 1.5% chance of exploitation in the next 30 days. Citrix Provisioning Services before 7.12 allows attackers to obtain sensitive kernel address information via unspecified vectors.