December 2017
1,120 CVEs published, 2.1× December 2016. CISA added 0 to KEV.
2017 month by month
| Year | Jan | Feb | Mar | Apr | May | Jun | Jul | Aug | Sep | Oct | Nov | Dec | Year total |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2017 | January 2017: no snapshot | February 2017: 1,075 CVEs | March 2017: 1,373 CVEs | April 2017: no snapshot | May 2017: 4,155 CVEs | June 2017: no snapshot | July 2017: 1,313 CVEs | August 2017: 1,564 CVEs | September 2017: 1,238 CVEs | October 2017: 1,441 CVEs | November 2017: no snapshot | December 2017: 1,120 CVEs | 13,2798 of 12 months8/12 |
- Critical
- 22821% of the 1,106 with a CVSS score
- Added to CISA KEV
- 02 of this month's CVEs are in KEV, listed a median 1585 days after publication
- Vendors
- 4591,644 products
- Top weakness
- Memory Buffer BoundsCWE-119 · 159 CVEs
Who drove it
Vendors by distinct CVEs this month, with how many of those CVEs are now in CISA KEV and how far each moved in the ranking.
- 1AdobeAcrobat, Acrobat Dc, Acrobat Reader9517nonenew
- 2DebianDebian Linux, Most, Advanced Package Tool896nonenew
- 3GoogleAndroid8516nonenew
- 4IBMSecurity Guardium, Sterling File Gateway, Rational Doors Next Generation500nonenew
- 5CanonicalUbuntu Linux, Ubuntu482nonenew
- 6FoxitsoftwareFoxit Reader430nonenew
- 7Qualcomm, Inc.Android For Msm, Firefox OS For Msm, Qrd Android4312nonenew
- 8Google Inc.Android384nonenew
- 9Ооо «русбитех-астра»Astra Linux Special Edition, Astra Linux Special Edition Для «эльбрус», Astra Linux Common Edition384nonenew
- 10AppleiPhone OS, Mac OS X, tvOS341nonenew
- 11MicrosoftChakracore, Edge, Internet Explorer341nonenew
- 12Microsoft CorporationChakracore, Microsoft Edge, Internet Explorer, Chakracore, Microsoft Edge, Internet Explorer341nonenew
- 13Сообщество Свободного Программного ОбеспеченияDebian Gnu/linux, Linux, Libxcursor344nonenew
- 14LinuxLinux Kernel260nonenew
- 15Red HatEnterprise Linux Server, Enterprise Linux Desktop, Enterprise Linux Workstation259nonenew
- 16HuaweiTE60 Firmware, TE50 Firmware, TE40 Firmware170nonenew
- 17TgsoftVir.it Explorer, Vir.it Explorer Lite170nonenew
- 18Huawei Technologies Co., Ltd.TE40, TE50, TE60160nonenew
- 19ImagemagickImagemagick161nonenew
- 20F5BIG-IP Access Policy Manager, BIG-IP Advanced Firewall Manager, BIG-IP Analytics140nonenew
- 21F5 Networks, Inc.BIG-IP Ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Gtm, Link Controller, Pem, Websafe, BIG-IP Apm, BIG-IP Ltm, Aam, Afm, Analytics, Apm, Asm, Dns, Link Controller, Pem, Websafe140nonenew
- 22IkarussecurityAnti.virus140nonenew
- 23SapSap Kernel, Business Application Software Integrated Solution, Sap Hana Extended Application Services131nonenew
- 24SynologyPhoto Station, Diskstation Manager, Diskstation Manager (Dsm)130nonenew
- 25NasmNetwide Assembler110nonenew
Severity
How this month's CVEs score on CVSS; 14 have no score yet. Severity is not exploitation.
- Critical228
- High538
- Medium325
- Low15
New in the top 100
Not in the top 100 in any of the 24 months before.
What kind of weakness
Weakness classes (CWE) by distinct CVEs, with how far each moved in the ranking.
- CWE-119Memory Buffer Bounds159
- CWE-89SQL Injection128
- CWE-79XSS121
- CWE-200Information Exposure92
- CWE-125Out-of-bounds Read76
- CWE-20Improper Input Validation74
- CWE-416Use After Free51
- CWE-74Injection32
- CWE-352CSRF22
- CWE-787Out-of-bounds Write20
- CWE-22Path Traversal19
- CWE-476NULL Pointer Dereference19
- CWE-70418
- CWE-78OS Command Injection16
- CWE-843Type Confusion14
- CWE-287Improper Authentication12
- CWE-426Untrusted Search Path12
- CWE-362Race Condition11
- CWE-77210
- CWE-190Integer Overflow8
Where it landed
The month's CVEs by the sector of the software they affect. A CVE that touches several sectors counts in each.
- Operating Systems30021% of sector-tagged CVEs
- Consumer Software18213% of sector-tagged CVEs
- Mobile Apps14010% of sector-tagged CVEs
- Enterprise Software1349% of sector-tagged CVEs
- OSS Libraries1279% of sector-tagged CVEs
- Web & CMS Plugins1067% of sector-tagged CVEs
- Security Products937% of sector-tagged CVEs
- Networking Infrastructure624% of sector-tagged CVEs
- 7 smaller sectors160
- Not yet classified116
Which weakness, where
The top weakness classes against the vendors and the sectors that carried them.
The lighter the cell, the more CVEs. Point at one to read it.
| By vendor | 119Memory Buffer Bounds | 89SQL Injection | 79XSS | 200Information Exposure | 125Out-of-bounds Read | 20Improper Input Validation | 416Use After Free | 74Injection | 352CSRF | 787Out-of-bounds Write |
|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | 27 | 7 | 3 | 27 | 9 | 5 | ||||
| Debian | 11 | 1 | 3 | 6 | 19 | 4 | 3 | 5 | 5 | |
| 21 | 11 | 3 | 10 | 14 | 1 | |||||
| IBM | 3 | 14 | 14 | 1 | 1 | 2 | ||||
| Canonical | 3 | 9 | 3 | 6 | 4 | |||||
| Foxit | 13 | 13 | 16 | |||||||
| Foxitsoftware | 13 | 13 | 16 | |||||||
| Qualcomm, Inc. | 21 | 1 | 2 | 3 | 10 | |||||
| Google Inc. | 10 | 1 | 7 | 1 | 1 | |||||
| Ооо «русбитех-астра» | 5 | 10 | 2 | 3 | ||||||
| Apple | 19 | 4 | 2 | 3 | ||||||
| Microsoft | 24 | 6 | 3 |