Hello, welcome to this month's blog on the Microsoft patch release. This month the vendor is releasing 11 bulletins, five of which are rated Critical.
-
MS16-084 Cumulative Security Update for Internet Explorer (3169991) MS Rating: Critical
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3204) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Internet Explorer Memory Corruption Vulnerability (CVE-2016-3240) MS Rating: Critical
A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Internet Explorer Memory Corruption Vulnerability (CVE-2016-3241) MS Rating: Critical
A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Internet Explorer Memory Corruption Vulnerability (CVE-2016-3242) MS Rating: Critical
A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Internet Explorer Memory Corruption Vulnerability (CVE-2016-3243) MS Rating: Important
A remote code execution vulnerability exists when Internet Explorer improperly accesses an object in memory. This vulnerability may corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.
Internet Explorer Security Feature Bypass Vulnerability (CVE-2016-3245) MS Rating: Moderate
A security bypass vulnerability exists for Internet Explorer. An attacker could take advantage of the vulnerability to trick a user into connecting to a remote system.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3248) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3259) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3260) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Internet Explorer Information Disclosure Vulnerability (CVE-2016-3261) MS Rating: Important
An information disclosure vulnerability exists when the Microsoft Browser improperly handles objects in memory.
Microsoft Browser Memory Corruption Vulnerability (CVE-2016-3264) MS Rating: Critical
A remote code execution vulnerability exist when Microsoft Internet Explorer improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.
Microsoft Browser Information Disclosure Vulnerability (CVE-2016-3273) MS Rating: Important
An information disclosure vulnerability exists when the Microsoft Browser XSS Filter does not properly validate content under specific conditions.
Microsoft Browser Spoofing Vulnerability (CVE-2016-3274) MS Rating: Moderate
A spoofing vulnerability exists when a Microsoft browser does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website.
Microsoft Browser Spoofing Vulnerability (CVE-2016-3276) MS Rating: Important
A spoofing vulnerability exists when the Microsoft Browser in reader mode does not properly parse HTML content. An attacker who successfully exploited this vulnerability could trick a user by redirecting them to a specially crafted website.
Microsoft Browser Information Disclosure Vulnerability (CVE-2016-3277) MS Rating: Important
An information disclosure vulnerability exists when the Microsoft Browser improperly handles objects in memory.
-
MS16-085 Cumulative Security Update for Microsoft Edge (3169999) MS Rating: Critical
Microsoft Edge Security Feature Bypass (CVE-2016-3244) MS Rating: Important
A security bypass vulnerability exists when Microsoft Edge does not properly implement Address Space Layout Randomization (ASLR).
Microsoft Edge Memory Corruption Vulnerability (CVE-2016-3246) MS Rating: Critical
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3248) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3259) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3260) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Microsoft Browser Memory Corruption Vulnerability (CVE-2016-3264) MS Rating: Critical
A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory. This vulnerability may corrupt memory in such a way that enables an attacker to execute arbitrary code in the context of the current user.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3265) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3269) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
Scripting Engine Information Disclosure Vulnerability (CVE-2016-3271) MS Rating: Critical
An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user’s computer or data.
Microsoft Browser Information Disclosure Vulnerability (CVE-2016-3273) MS Rating: Moderate
An information disclosure vulnerability exists when the Microsoft Browser XSS Filter does not properly validate content under specific conditions.
Microsoft Browser Spoofing Vulnerability (CVE-2016-3274) MS Rating: Moderate
A spoofing vulnerability exists when a Microsoft browser does not properly parse HTTP content. An attacker who successfully exploited this vulnerability could trick a user by redirecting the user to a specially crafted website.
Microsoft Browser Spoofing Vulnerability (CVE-2016-3276) MS Rating: Important
A spoofing vulnerability exists when the Microsoft Browser in reader mode does not properly parse HTML content. An attacker who successfully exploited this vulnerability could trick a user by redirecting them to a specially crafted website.
Microsoft Browser Information Disclosure Vulnerability (CVE-2016-3277) MS Rating: Important
An information disclosure vulnerability exists when the Microsoft Browser improperly handles objects in memory.
-
MS16-086 Cumulative Security Update for JScript and VBScript (3169996) MS Rating: Critical
Scripting Engine Memory Corruption Vulnerability (CVE-2016-3204) MS Rating: Critical
A remote code execution vulnerability exists in the way that the JScript 9 and VBScript engines render when handling objects in memory in Internet Explorer.
-
MS16-087 Security Update for Windows Print Spooler Components (3170005) MS Rating: Critical
Microsoft Print Spooler Remote Code Execution Vulnerability (CVE-2016-3238) MS Rating: Critical
A remote code execution vulnerability exists in Windows when the Print Spooler service does not properly validate print drivers while installing a printer from servers.
Windows Print Spooler Elevation of Privilege Vulnerability (CVE-2016-3239) MS Rating: Important
An elevation of privilege vulnerability exists when the Microsoft Windows Print Spooler service improperly allows arbitrary writing to the file system.
-
MS16-088 Security Update for Microsoft Office (3170008) MS Rating: Important
Microsoft Office Memory Corruption Vulnerability (CVE-2016-3278) MS Rating: Important
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Microsoft Office Remote Code Execution Vulnerability (CVE-2016-3279) MS Rating: Important
A vulnerability exists when Microsoft Office fails to properly handle XLA files. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.
Microsoft Office Memory Corruption Vulnerability (CVE-2016-3280) MS Rating: Important
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Microsoft Office Memory Corruption Vulnerability (CVE-2016-3281) MS Rating: Important
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Microsoft Office Memory Corruption Vulnerability (CVE-2016-3282) MS Rating: Important
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Microsoft Office Memory Corruption Vulnerability (CVE-2016-3283) MS Rating: Important
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
Microsoft Office Memory Corruption Vulnerability (CVE-2016-3284) MS Rating: Important
A remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.
-
MS16-089 Security Update for Windows Secure Kernel Mode (3170050) MS Rating: Important
Windows Secure Kernel Mode Information Disclosure Vulnerability (CVE-2016-3256) MS Rating: Important
An information disclosure vulnerability exists when Windows Secure Kernel Mode improperly handles objects in memory. A locally-authenticated attacker who successfully exploited this vulnerability could be able to read sensitive information on the target system.
-
MS16-090 Security Update for Windows Kernel-Mode Drivers (3171481) MS Rating: Important
Win32k Elevation of Privilege Vulnerability (CVE-2016-3249) MS Rating: Important
An elevation of privilege vulnerability exists when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could run arbitrary code in kernel mode.
Win32k Elevation of Privilege Vulnerability (CVE-2016-3250) MS Rating: Important
An elevation of privilege vulnerability exists when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could run arbitrary code in kernel mode.
GDI Component Information Disclosure Vulnerability (CVE-2016-3251) MS Rating: Important
An information disclosure vulnerability exists when the Windows GDI component improperly discloses kernel memory addresses. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
Win32k Elevation of Privilege Vulnerability (CVE-2016-3252) MS Rating: Important
An elevation of privilege vulnerability exists when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could run arbitrary code in kernel mode.
Win32k Elevation of Privilege Vulnerability (CVE-2016-3254) MS Rating: Important
An elevation of privilege vulnerability exists when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could run arbitrary code in kernel mode.
Win32k Elevation of Privilege Vulnerability (CVE-2016-3286) MS Rating: Important
An elevation of privilege vulnerability exists when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited these vulnerabilities could run arbitrary code in kernel mode.
-
MS16-091 Security Update for .NET Framework (3170048) MS Rating: Important
.NET Information Disclosure Vulnerability (CVE-2016-3255) MS Rating: Important
An information disclosure vulnerability exists when .NET Framework improperly parses XML input containing a reference to an external entity.
-
MS16-092 Security Update for Windows Kernel (3171910) MS Rating: Important
Windows File System Security Feature Bypass Vulnerability (CVE-2016-3258) MS Rating: Important
A security bypass vulnerability exists in the Windows kernel that could allow an attacker to exploit time of check time of use (TOCTOU) issues in file path-based checks from a low integrity application.
Windows Kernel Information Disclosure Vulnerability (CVE-2016-3272) MS Rating: Important
An information disclosure vulnerability exists in Microsoft Windows when the Windows kernel fails to properly handle certain page fault system calls. An authenticated attacker who successfully exploited this vulnerability could disclose information from one process to another.
-
MS16-093 Security Update for Adobe Flash Player (3173337) MS Rating: Critical
Security updates available for Flash Player MS Rating: Critical
Multiple security vulnerabilities exist in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.
-
MS16-094 Security Update for Secure Boot (3175677) MS Rating: Important
Secure Boot Security Feature Bypass Vulnerability (CVE-2016-3287) MS Rating: Important
A security bypass vulnerability exists when Windows Secure Boot improperly applies an affected policy. An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded on a target device.
More information on the vulnerabilities being addressed this month is available at Symantec's free Security Response portal and to our customers through the DeepSight Threat Management System.