Hello, welcome to this month's blog on the Microsoft patch release. This month the vendor is releasing nine bulletins, six of which are rated Critical.
-
MS16-001 Cumulative Security Update for Internet Explorer (3124903)
Scripting Engine Memory Corruption Vulnerability (CVE-2016-0002) MS Rating: Critical
A remote code execution vulnerability exists in the way that the VBScript engine renders when handling objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Internet Explorer Elevation of Privilege Vulnerability (CVE-2016-0005) MS Rating: Important
An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain. The update addresses the vulnerability by helping to ensure that cross-domain policies are properly enforced in Internet Explorer.
-
MS16-002 Cumulative Security Update for Microsoft Edge (3124904)
Microsoft Edge Memory Vulnerability (CVE-2016-0003) MS Rating: Critical
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-0024) MS Rating: Critical
A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
-
MS16-003 Cumulative Security Update for JScript and VBScript to Address Remote Code Execution (3125540)
Scripting Engine Memory Corruption Vulnerability (CVE-2016-0002) MS Rating: Critical
A remote code execution vulnerability exists in the way that the VBScript engine renders when handling objects in memory in Internet Explorer.
-
MS16-004 Security Update for Microsoft Office to Address Remote Code Execution (3124585)
Microsoft SharePoint Security Feature Bypass (CVE-2016-0011) MS Rating: Important
A security feature bypass exists in Microsoft SharePoint when Access Control Policy (ACP) configuration settings are not enforced correctly.
Microsoft SharePoint Security Feature Bypass (CVE-2015-6117) MS Rating: Important
A security feature bypass exists in Microsoft SharePoint when Access Control Policy (ACP) configuration settings are not enforced correctly.
Microsoft Office Memory Corruption Vulnerability (CVE-2016-0010) MS Rating: Critical
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user.
Microsoft Office ASLR Bypass (CVE-2016-0012) MS Rating: Important
A security feature bypass exists when Microsoft Office fails to use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack.
Microsoft Office Memory Corruption Vulnerability (CVE-2016-0035) MS Rating: Important
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in the context of the current user.
-
MS16-005 Security Update for Windows Kernel-Mode Drivers to Address Remote Code Execution (3124584)
Windows GDI32.dll ASLR Bypass Vulnerability (CVE-2016-0008) MS Rating: Important
A security feature bypass vulnerability exists in the way that the Windows graphics device interface handles objects in memory, allowing an attacker to retrieve information that could lead to an Address Space Layout Randomization (ASLR) bypass.
Win32k Remote Code Execution Vulnerability (CVE-2016-0009) MS Rating: Critical
A remote code execution vulnerability exists in the way that Windows handles objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code on a target system.
-
MS16-006 Security Update for Silverlight to Address Remote Code Execution (3126036)
Silverlight Runtime Remote Code Execution Vulnerability (CVE-2016-0034) MS Rating: Critical
A remote code execution vulnerability exists when Microsoft Silverlight decodes strings using a malicious decoder that can return negative offsets that cause Silverlight to replace unsafe object headers with contents provided by an attacker.
-
MS16-007 Security Update for Microsoft Windows to Address Remote Code Execution (3124901)
DLL Loading Elevation of Privilege Vulnerability (CVE-2016-0014) MS Rating: Important
An elevation of privilege vulnerability exists when Windows improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited the vulnerability could elevate their privileges on a targeted system.
DirectShow Heap Corruption Remote Code Execution Vulnerability (CVE-2016-0015) MS Rating: Important
A remote code execution vulnerability exists when DirectShow improperly validates user input. An attacker who successfully exploited this vulnerability could cause arbitrary code to execute in the context of the current user. If a user is logged on with administrative user rights, an attacker could take complete control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
DLL Loading Remote Code Execution Vulnerability (CVE-2016-0016) MS Rating: Important
A remote code execution vulnerability exists when Windows improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
DLL Loading Remote Code Execution Vulnerability (CVE-2016-0018) MS Rating: Important
A remote code execution vulnerability exists when Windows improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Windows Remote Desktop Protocol Security Bypass Vulnerability (CVE-2016-0019) MS Rating: Important
A security feature bypass vulnerability exists in Windows Remote Desktop Protocol (RDP) that is caused when Windows 10 hosts running RDP services fail to prevent remote logon to accounts that have no passwords set. An attacker who successfully exploited this vulnerability could gain access to the remote host as another user, possibly with elevated privileges.
MAPI DLL Loading Elevation of Privilege Vulnerability (CVE-2016-0020) MS Rating: Important
An elevation of privilege vulnerability exists when Windows improperly validates input before loading dynamic link library (DLL) files. An attacker who successfully exploited the vulnerability could elevate their privileges on a targeted system.
-
MS16-008 Security Update for Kernel to Address Elevation of Privilege (3124605)
Windows Mount Point Elevation of Privilege Vulnerability (CVE-2016-0006) MS Rating: Important
A vulnerability exists in Windows while validating reparse points being set by sandbox applications. An attacker who successfully exploited the vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Windows Mount Point Elevation of Privilege Vulnerability (CVE-2016-0007) MS Rating: Important
A vulnerability exists in Windows while validating reparse points being set by sandbox applications. An attacker who successfully exploited the vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
-
MS16-010 Security Update for Exchange server to Address Spoofing (3124557)
Exchange Spoofing Vulnerability (CVE-2016-0029) MS Rating: Important
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks, and attempt to trick the user into disclosing sensitive information. An attacker could also redirect the user to a malicious website that could spoof content or be used as a pivot to chain an attack with other vulnerabilities in web services.
Exchange Spoofing Vulnerability (CVE-2016-0030) MS Rating: Important
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks and attempt to trick the user into disclosing sensitive information. An attacker could also redirect the user to a malicious website that could spoof content or be used as a pivot to chain an attack with other vulnerabilities in web services.
Exchange Spoofing Vulnerability (CVE-2016-0031) MS Rating: Important
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks and attempt to trick the user into disclosing sensitive information. An attacker could also redirect the user to a malicious website that could spoof content or be used as a pivot to chain an attack with other vulnerabilities in web services.
Exchange Spoofing Vulnerability (CVE-2016-0032) MS Rating: Important
A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited the vulnerability could perform script or content injection attacks and attempt to trick the user into disclosing sensitive information. An attacker could also redirect the user to a malicious website that could spoof content or be used as a pivot to chain an attack with other vulnerabilities in web services.
More information on the vulnerabilities being addressed this month is available at Symantec's free Security Response portal and to our customers through the DeepSight Threat Management System.