Microsoft security alert.

Advisory overview

Qualys Vulnerability R&D Lab has released new vulnerability checks in the Enterprise TruRisk Platform to protect organizations against 76 vulnerabilities that were fixed in 14 bulletins announced today by Microsoft. Customers can immediately audit their networks for these and other new vulnerabilities by accessing their Qualys subscription. Visit Qualys Security Blog to prioritize remediation.

Non-Qualys customers can audit their network for these and other vulnerabilities by signing up for a Qualys Free Trial, or by trying Qualys Community Edition.

Vulnerability details

Microsoft has released 14 security bulletins to fix newly discovered flaws in their software. Qualys has released the following checks for these new vulnerabilities:

• Microsoft Cumulative Security Update for Internet Explorer (MS16-104)

  Severity

  Critical 4

  Qualys ID

  100295

  Vendor Reference

  MS16-104

  CVE Reference

  CVE-2016-3247, CVE-2016-3291, CVE-2016-3292, CVE-2016-3295, CVE-2016-3297, CVE-2016-3324, CVE-2016-3325, CVE-2016-3351, CVE-2016-3353, CVE-2016-3375

  CVSS Scores

  Base 7.6 / Temporal 6.6

  Description

  This security update is rated Critical for Internet Explorer 9 (IE 9), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.

  The update addresses the vulnerabilities by correcting how Internet Explorer handles:
  zone and integrity settings.
  cross-origin content.
  objects in memory.
  .URL files.

  Consequence

  The most severe vulnerabilities could allow remote code execution if a user views a specially crafted web page using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

  Solution

  Customers are advised to refer to Microsoft Advisory MS16-104 for more details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-104 Windows 10 Version 1511 for 32-bit Systems
  MS16-104 Windows 10 Version 1511 for x64-based Systems
  MS16-104 Windows 10 Version 1607 for 32-bit Systems
  MS16-104 Windows 10 Version 1607 for x64-based Systems
  MS16-104 Windows 10 for 32-bit Systems
  MS16-104 Windows 10 for x64-based Systems
  MS16-104 Windows 7 for 32-bit Systems Service Pack 1(Internet Explorer 11)
  MS16-104 Windows 7 for x64-based Systems Service Pack 1(Internet Explorer 11)
  MS16-104 Windows 8.1 for 32-bit Systems(Internet Explorer 11)
  MS16-104 Windows 8.1 for x64-based Systems(Internet Explorer 11)
  MS16-104 Windows Server 2008 R2 for x64-based Systems Service Pack 1(Internet Explorer 11)
  MS16-104 Windows Server 2008 for 32-bit Systems Service Pack 2(Internet Explorer 9)
  MS16-104 Windows Server 2008 for x64-based Systems Service Pack 2(Internet Explorer 9)
  MS16-104 Windows Server 2012(Internet Explorer 10)
  MS16-104 Windows Server 2012 R2(Internet Explorer 11)
  MS16-104 Windows Vista Service Pack 2(Internet Explorer 9)
  MS16-104 Windows Vista x64 Edition Service Pack 2(Internet Explorer 9)

• Microsoft Edge Cumulative Security Update (MS16-105)

  Severity

  Critical 4

  Qualys ID

  91270

  Vendor Reference

  MS16-105

  CVE Reference

  CVE-2016-3247, CVE-2016-3291, CVE-2016-3294, CVE-2016-3295, CVE-2016-3297, CVE-2016-3325, CVE-2016-3330, CVE-2016-3350, CVE-2016-3351, CVE-2016-3370, CVE-2016-3374, CVE-2016-3377

  CVSS Scores

  Base 7.6 / Temporal 6.6

  Description

  This security update is rated Critical for Microsoft Edge on Windows 10. This security update resolves vulnerabilities in Microsoft Edge by:
  modifying how Microsoft Edge and certain functions handle objects in memory.
  modifying how the Chakra JavaScript scripting engine handles objects in memory.
  correcting how Microsoft Edge handles cross-origin requests.
  ensuring that Microsoft Edge properly implements the Address Space Layout Randomization (ASLR) security feature.
  helping to ensure that Microsoft Edge properly validates page content.

  Consequence

  An attacker who has successfully exploited the vulnerabilities could gain the same user rights as the current user.

  Solution

  Customers are advised to refer to Microsoft Security Bulletin MS16-105 for details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-105 Windows 10 Version 1511 for 32-bit Systems
  MS16-105 Windows 10 Version 1511 for x64-based Systems
  MS16-105 Windows 10 Version 1607 for 32-bit Systems
  MS16-105 Windows 10 Version 1607 for x64-based Systems
  MS16-105 Windows 10 for 32-bit Systems
  MS16-105 Windows 10 for x64-based Systems

• Microsoft Graphics Component Remote Code Execution Vulnerabilities (MS16-106)

  Severity

  Critical 4

  Qualys ID

  91275

  Vendor Reference

  MS16-106

  CVE Reference

  CVE-2016-3348, CVE-2016-3349, CVE-2016-3354, CVE-2016-3355, CVE-2016-3356

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  This security update is rated Critical for supported editions of Windows 10 Version 1607 and rated Important for all other supported releases of Windows. The security update addresses the vulnerabilities by correcting how certain Windows kernel-mode drivers and the Windows Graphics Device Interface(GDI) handle objects in memory and by preventing instances of unintended user-mode privilege elevation.

  Consequence

  The most severe of the vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document.

  Solution

  Customers are advised to refer to MS16-106 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-106 Windows 10 Version 1511 for 32-bit Systems
  MS16-106 Windows 10 Version 1511 for x64-based Systems
  MS16-106 Windows 10 Version 1607 for 32-bit Systems
  MS16-106 Windows 10 Version 1607 for x64-based Systems
  MS16-106 Windows 10 for 32-bit Systems
  MS16-106 Windows 10 for x64-based Systems
  MS16-106 Windows 7 for 32-bit Systems Service Pack 1
  MS16-106 Windows 7 for x64-based Systems Service Pack 1
  MS16-106 Windows 8.1 for 32-bit Systems
  MS16-106 Windows 8.1 for x64-based Systems
  MS16-106 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
  MS16-106 Windows Server 2008 R2 for x64-based Systems Service Pack 1
  MS16-106 Windows Server 2008 for 32-bit Systems Service Pack 2
  MS16-106 Windows Server 2008 for Itanium-based Systems Service Pack 2
  MS16-106 Windows Server 2008 for x64-based Systems Service Pack 2
  MS16-106 Windows Server 2012
  MS16-106 Windows Server 2012 R2
  MS16-106 Windows Vista Service Pack 2
  MS16-106 Windows Vista x64 Edition Service Pack 2

• Microsoft Office Remote Code Execution Vulnerabilities (MS16-107)

  Severity

  Critical 4

  Qualys ID

  110283

  Vendor Reference

  MS16-107

  CVE Reference

  CVE-2016-0137, CVE-2016-0141, CVE-2016-3357, CVE-2016-3358, CVE-2016-3359, CVE-2016-3360, CVE-2016-3361, CVE-2016-3362, CVE-2016-3363, CVE-2016-3364, CVE-2016-3365, CVE-2016-3366, CVE-2016-3381

  CVSS Scores

  Base 9.3 / Temporal 7.3

  Description

  This security update resolves vulnerabilities in Microsoft Office.
  The security update addresses the vulnerabilities by correcting how:
  Microsoft Office saves documents.
  Click-to-Run components handle memory addresses.
  affected versions of Office and Office components handle objects in memory.
  Microsoft Outlook determines the end of MIME messages.
  

  Consequence

  The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.

  Solution

  Refer to MS16-107 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-107 Excel Automation Services on Microsoft SharePoint Server 2013 Service Pack 1
  MS16-107 Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (32-bit editions)
  MS16-107 Excel Services on Microsoft SharePoint Server 2007 Service Pack 3 (64-bit editions)
  MS16-107 Excel Services on Microsoft SharePoint Server 2010 Service Pack 2
  MS16-107 Microsoft Excel 2007 Service Pack 3
  MS16-107 Microsoft Excel 2010 Service Pack 2 (32-bit editions)
  MS16-107 Microsoft Excel 2010 Service Pack 2 (64-bit editions)
  MS16-107 Microsoft Excel 2013 Service Pack 1 (32-bit editions)
  MS16-107 Microsoft Excel 2013 Service Pack 1 (64-bit editions)
  MS16-107 Microsoft Excel 2016 (32-bit edition)
  MS16-107 Microsoft Excel 2016 (64-bit edition)
  MS16-107 Microsoft Excel 2016 for Mac
  MS16-107 Microsoft Excel Viewer
  MS16-107 Microsoft Office 2007 Service Pack 3
  MS16-107 Microsoft Office 2010 Service Pack 2 (32-bit editions)
  MS16-107 Microsoft Office 2010 Service Pack 2 (32-bit editions)
  MS16-107 Microsoft Office 2010 Service Pack 2 (64-bit editions)
  MS16-107 Microsoft Office 2010 Service Pack 2 (64-bit editions)
  MS16-107 Microsoft Office 2013 Service Pack 1 (32-bit editions)
  MS16-107 Microsoft Office 2013 Service Pack 1 (64-bit editions)
  MS16-107 Microsoft Office 2016 (32-bit edition)
  MS16-107 Microsoft Office 2016 (64-bit edition)
  MS16-107 Microsoft Office Compatibility Pack Service Pack 3
  MS16-107 Microsoft Office Compatibility Pack Service Pack 3
  MS16-107 Microsoft Office Web Apps 2010 Service Pack 2
  MS16-107 Microsoft Office Web Apps Server 2013 Service Pack 1
  MS16-107 Microsoft Outlook 2007
  MS16-107 Microsoft Outlook 2010 Service Pack 2 (32-bit editions)
  MS16-107 Microsoft Outlook 2010 Service Pack 2 (64-bit editions)
  MS16-107 Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
  MS16-107 Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
  MS16-107 Microsoft Outlook 2016 (32-bit edition)
  MS16-107 Microsoft Outlook 2016 (64-bit edition)
  MS16-107 Microsoft Outlook 2016 for Mac
  MS16-107 Microsoft PowerPoint 2007 Service Pack 3
  MS16-107 Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)
  MS16-107 Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)
  MS16-107 Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions)
  MS16-107 Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions)
  MS16-107 Microsoft PowerPoint 2016 for Mac
  MS16-107 Microsoft PowerPoint Viewer
  MS16-107 Microsoft SharePoint Server 2013 Service Pack 1
  MS16-107 Microsoft Word 2016 for Mac
  MS16-107 Microsoft Word Viewer
  MS16-107 Microsoft Word for Mac 2011
  MS16-107 Office Online Server
  MS16-107 Word Automation Services on Microsoft SharePoint Server 2010 Service Pack 2
  MS16-107 Word Automation Services on Microsoft SharePoint Server 2013 Service Pack 1

• Microsoft Exchange Server Address Multiple Vulnerabilities (MS16-108)

  Severity

  Urgent 5

  Qualys ID

  53005

  Vendor Reference

  MS16-108

  CVE Reference

  CVE-2016-0138, CVE-2016-3378, CVE-2016-3379

  CVSS Scores

  Base 5.8 / Temporal 4.5

  Description

  This security update resolves vulnerabilities in Microsoft Exchange Server.
  The security update addresses the vulnerabilities by correcting how Microsoft Exchange: - parses certain unstructured file formats. - handles open redirect requests. - handles Microsoft Outlook meeting invitation requests. This security update is rated Critical for all supported editions of Microsoft Exchange Server 2007, Microsoft Exchange Server 2010, Microsoft Exchange Server 2013, and Microsoft Exchange Server 2016.

  Consequence

  The most severe of the vulnerabilities could allow remote code execution in some Oracle Outside In libraries that are built into Exchange Server

  Solution

  Please refer to MS16-108 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-108 Microsoft Exchange Server 2007 Service Pack 3
  MS16-108 Microsoft Exchange Server 2010 Service Pack 3
  MS16-108 Microsoft Exchange Server 2013 Cumulative Update 12
  MS16-108 Microsoft Exchange Server 2013 Cumulative Update 13
  MS16-108 Microsoft Exchange Server 2013 Service Pack 1
  MS16-108 Microsoft Exchange Server 2016 Cumulative Update 1
  MS16-108 Microsoft Exchange Server 2016 Cumulative Update 2

• Microsoft Silverlight Remote Code Execution Vulnerability (MS16-109)

  Severity

  Critical 4

  Qualys ID

  91272

  Vendor Reference

  MS16-109

  CVE Reference

  CVE-2016-3367

  CVSS Scores

  Base 9.3 / Temporal 6.9

  Description

  A remote code execution vulnerability exists when Microsoft Silverlight improperly allows applications to access objects in memory.

  The update addresses the vulnerability by correcting how Microsoft Silverlight allocates memory for inserting and appending strings in StringBuilder.

  This security update is rated Important for Microsoft Silverlight 5 and Microsoft Silverlight 5 Developer Runtime when installed on Mac or all supported releases of Microsoft Windows.

  Consequence

  Successful exploitation allows attacker to execute arbitrary code.

  Solution

  Refer to Microsoft Security Bulletin MS16-109 for further details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-109 Microsoft Silverlight 5
  MS16-109 Microsoft Silverlight 5 Developer Runtime

• Microsoft Windows Multiple Vulnerabilities (MS16-110)

  Severity

  Critical 4

  Qualys ID

  91268

  Vendor Reference

  MS16-110

  CVE Reference

  CVE-2016-3346, CVE-2016-3352, CVE-2016-3368, CVE-2016-3369

  CVSS Scores

  Base 9 / Temporal 6.7

  Description

  This security update resolves vulnerabilities in Microsoft Windows.
  The security update addresses the vulnerabilities by:
  correcting how Windows enforces permissions.
  preventing NT LAN Manager (NTLM) Single Sign-On (SSO) authentication to non-private SMB resources when users are signed in to Windows via a Microsoft Account (https://www.microsoft.com/account) and connected to a Guest or public networks firewall profile. correcting how Windows handles objects in memory.
  This security update is rated Important for all supported releases of Microsoft Windows excluding Itanium servers, which are not affected.
  

  Consequence

  The most severe of the vulnerabilities could allow remote code execution if an attacker creates a specially crafted request and executes arbitrary code with elevated permissions on a target system.

  Solution

  Customers are advised to refer to Microsoft Advisory MS16-110 for more details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-110 Windows 10 Version 1511 for 32-bit Systems
  MS16-110 Windows 10 Version 1511 for x64-based Systems
  MS16-110 Windows 10 Version 1607 for 32-bit Systems
  MS16-110 Windows 10 Version 1607 for x64-based Systems
  MS16-110 Windows 10 for 32-bit Systems
  MS16-110 Windows 10 for x64-based Systems
  MS16-110 Windows 7 for 32-bit Systems Service Pack 1
  MS16-110 Windows 7 for x64-based Systems Service Pack 1
  MS16-110 Windows 8.1 for 32-bit Systems
  MS16-110 Windows 8.1 for 32-bit Systems
  MS16-110 Windows 8.1 for x64-based Systems
  MS16-110 Windows 8.1 for x64-based Systems
  MS16-110 Windows Server 2008 R2 for x64-based Systems Service Pack 1
  MS16-110 Windows Server 2008 for 32-bit Systems Service Pack 2
  MS16-110 Windows Server 2008 for x64-based Systems Service Pack 2
  MS16-110 Windows Server 2012
  MS16-110 Windows Server 2012 R2
  MS16-110 Windows Vista Service Pack 2
  MS16-110 Windows Vista x64 Edition Service Pack 2

• Microsoft Windows Kernel Elevation of Privilege Vulnerabilities (MS16-111)

  Severity

  Critical 4

  Qualys ID

  91276

  Vendor Reference

  MS16-111

  CVE Reference

  CVE-2016-3305, CVE-2016-3306, CVE-2016-3371, CVE-2016-3372, CVE-2016-3373

  CVSS Scores

  Base 4.6 / Temporal 3.8

  Description

  Microsoft Windows Kernel are prone to multiple privilege escalation vulnerabilities affecting the Windows Kernel API and the handling of session objects.

  Microsoft released a security update that addresses the vulnerabilities by correcting how Windows handles session objects and properly enforcing Windows Kernel API permissions.

  This security update is rated Important for all supported releases of Microsoft Windows.

  Consequence

  The most severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.

  Solution

  Customers are advised to refer to MS16-111 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-111 Windows 10 Version 1511 x32
  MS16-111 Windows 10 Version 1511 x64
  MS16-111 Windows 10 Version 1607 x32
  MS16-111 Windows 10 Version 1607 x64
  MS16-111 Windows 10 Version 1703 for x64-based Systems
  MS16-111 Windows 10 Version 1703 for x86-based Systems
  MS16-111 Windows 10 x32
  MS16-111 Windows 10 x64
  MS16-111 Windows 2008 x32 Service Pack 2
  MS16-111 Windows 2008 x64 Service Pack 2
  MS16-111 Windows 7 x32 Service Pack 1
  MS16-111 Windows 7 x64 Service Pack 1
  MS16-111 Windows 8.1 x32
  MS16-111 Windows 8.1 x64
  MS16-111 Windows RT 8.1
  MS16-111 Windows Server 2008 R2 x64 Service Pack 1
  MS16-111 Windows Server 2008 R2 x64 Service Pack 1 (CORE)
  MS16-111 Windows Server 2008 x32 Service Pack 2 (CORE)
  MS16-111 Windows Server 2008 x64 Service Pack 2 (CORE)
  MS16-111 Windows Server 2012
  MS16-111 Windows Server 2012 (CORE)
  MS16-111 Windows Server 2012 R2
  MS16-111 Windows Server 2012 R2 (CORE)
  MS16-111 Windows Vista Service Pack 2
  MS16-111 Windows Vista x64 Service Pack 2

• Microsoft Windows Lock Screen Elevation of Privilege Vulnerability (MS16-112)

  Severity

  Serious 3

  Qualys ID

  91274

  Vendor Reference

  MS16-112

  CVE Reference

  CVE-2016-3302

  CVSS Scores

  Base 6.2 / Temporal 4.6

  Description

  An elevation of privilege vulnerability exists when Windows improperly allows web content to load from the Windows lock screen.

  The security update addresses the vulnerability by correcting the behavior of the Windows lock screen to prevent unintended web content from loading.

  This security update is rated Important for all supported editions of Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, and Windows 10.

  Consequence

  An attacker who successfully exploited the vulnerability could potentially execute code on a user's locked computer.

  Solution

  Customers are advised to refer to Microsoft Advisory MS16-112 for more details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-112 Windows 10 Version 1511 for 32-bit Systems
  MS16-112 Windows 10 Version 1511 for x64-based Systems
  MS16-112 Windows 10 Version 1607 for 32-bit Systems
  MS16-112 Windows 10 Version 1607 for x64-based Systems
  MS16-112 Windows 10 for 32-bit Systems
  MS16-112 Windows 10 for x64-based Systems
  MS16-112 Windows 8.1 for 32-bit Systems
  MS16-112 Windows 8.1 for x64-based Systems
  MS16-112 Windows Server 2012 R2
  MS16-112 Windows Server 2012 R2

• Microsoft Windows Secure Kernel Mode Information Disclosure Vulnerability (MS16-113)

  Severity

  Critical 4

  Qualys ID

  91269

  Vendor Reference

  MS16-113

  CVE Reference

  CVE-2016-3344

  CVSS Scores

  Base 2.1 / Temporal 1.6

  Description

  An information disclosure vulnerability exists in Windows when Windows Secure Kernel Mode improperly handles objects in memory.

  his security update is rated Important for all supported editions of Windows 10 and Windows 10 Version 1511.

  Consequence

  Successful exploitation allows an attacker to compromise the system.

  Solution

  Customers are advised to refer to MS16-113 for more information.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-113 Windows 10 Version 1511 for 32-bit Systems
  MS16-113 Windows 10 Version 1511 for x64-based Systems
  MS16-113 Windows 10 for 32-bit Systems
  MS16-113 Windows 10 for x64-based Systems

• Microsoft SMB Server Remote Code Execution Vulnerability (MS16-114)

  Severity

  Critical 4

  Qualys ID

  91267

  Vendor Reference

  MS16-114

  CVE Reference

  CVE-2016-3345

  CVSS Scores

  Base 9 / Temporal 6.7

  Description

  Microsoft Server Message Block (SMB) Protocol is a Microsoft network file sharing protocol used in Microsoft Windows.

  The security update addresses the vulnerability by correcting how the Microsoft SMBv1 Server handles specially crafted requests. The vulnerability could allow remote code execution if an authenticated attacker sends specially crafted packets to an affected Microsoft Server Message Block 1.0 (SMBv1) Server on Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2.

  This security update is rated Important for all supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows Server 2012, 2012 R2, Windows RT 8.1, and Windows 10

  Consequence

  To exploit the vulnerability an attacker would first need to authenticate to the SMBv1 Server and have permission to open files on the target server before attempting the attack. The vulnerability could cause the affected system to stop responding until it is manually restarted.

  Solution

  Customers are advised to refer to Microsoft Advisory MS16-114 for more details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-114 Windows 10 Version 1511 for 32-bit Systems
  MS16-114 Windows 10 Version 1511 for x64-based Systems
  MS16-114 Windows 10 Version 1607 for 32-bit Systems
  MS16-114 Windows 10 Version 1607 for x64-based Systems
  MS16-114 Windows 10 for 32-bit Systems
  MS16-114 Windows 10 for x64-based Systems
  MS16-114 Windows 7 for 32-bit Systems Service Pack 1
  MS16-114 Windows 7 for x64-based Systems Service Pack 1
  MS16-114 Windows 8.1 for 32-bit Systems
  MS16-114 Windows 8.1 for x64-based Systems
  MS16-114 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
  MS16-114 Windows Server 2008 R2 for x64-based Systems Service Pack 1
  MS16-114 Windows Server 2008 R2 for x64-based Systems Service Pack 1
  MS16-114 Windows Server 2008 for 32-bit Systems Service Pack 2
  MS16-114 Windows Server 2008 for Itanium-based Systems Service Pack 2
  MS16-114 Windows Server 2008 for x64-based Systems Service Pack 2
  MS16-114 Windows Server 2012
  MS16-114 Windows Server 2012 R2
  MS16-114 Windows Vista Service Pack 2
  MS16-114 Windows Vista x64 Edition Service Pack 2

• Microsoft Windows PDF Library Multiple Information Disclosure Vulnerabilities (MS16-115)

  Severity

  Serious 3

  Qualys ID

  91271

  Vendor Reference

  MS16-115

  CVE Reference

  CVE-2016-3370, CVE-2016-3374

  CVSS Scores

  Base 4.3 / Temporal 3.6

  Description

  Multiple information disclosure vulnerabilities exist in the way that the Windows PDF Library handles objects in memory.

  This security update is rated Important for all supported editions of Windows 8.1, Windows Server 2012, Windows RT 8.1, Windows Server 2012 R2, and Windows 10.

  Consequence

  An attacker who successfully exploited the vulnerabilities could obtain information to further compromise a target system.

  Solution

  Customers are advised to refer to Microsoft Advisory MS16-115 for more details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-115 Windows 10 Version 1511 for 32-bit Systems
  MS16-115 Windows 10 Version 1511 for x64-based Systems
  MS16-115 Windows 10 Version 1607 for 32-bit Systems
  MS16-115 Windows 10 Version 1607 for x64-based Systems
  MS16-115 Windows 10 for 32-bit Systems
  MS16-115 Windows 10 for x64-based Systems
  MS16-115 Windows 8.1 for 32-bit Systems
  MS16-115 Windows 8.1 for x64-based Systems
  MS16-115 Windows Server 2012
  MS16-115 Windows Server 2012 R2

• Microsoft VBScript Scripting Engine Memory Corruption Vulnerability (MS16-116)

  Severity

  Urgent 5

  Qualys ID

  91273

  Vendor Reference

  MS16-116

  CVE Reference

  CVE-2016-3375

  CVSS Scores

  Base 7.6 / Temporal 5.6

  Description

  A remote code execution vulnerability exists in the way that the Microsoft OLE Automation mechanism and the VBScript Scripting Engine in Internet Explorer access objects in memory.

  The security update affects all supported releases of Microsoft Windows and is rated Critical on client operating systems and Moderate on servers.

  Consequence

  Successful exploitation allows an attacker to execute arbitrary code.

  Solution

  Customers are advised to refer to Microsoft Security Bulletin MS16-116 for details.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-116 Windows 10 Version 1511 for 32-bit Systems
  MS16-116 Windows 10 Version 1511 for x64-based Systems
  MS16-116 Windows 10 Version 1607 for 32-bit Systems
  MS16-116 Windows 10 Version 1607 for x64-based Systems
  MS16-116 Windows 10 for 32-bit Systems
  MS16-116 Windows 10 for x64-based Systems
  MS16-116 Windows 7 for 32-bit Systems Service Pack 1
  MS16-116 Windows 7 for x64-based Systems Service Pack 1
  MS16-116 Windows 8.1 for 32-bit Systems
  MS16-116 Windows 8.1 for x64-based Systems
  MS16-116 Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
  MS16-116 Windows Server 2008 R2 for x64-based Systems Service Pack 1
  MS16-116 Windows Server 2008 for 32-bit Systems Service Pack 2
  MS16-116 Windows Server 2008 for Itanium-based Systems Service Pack 2
  MS16-116 Windows Server 2008 for x64-based Systems Service Pack 2
  MS16-116 Windows Server 2012
  MS16-116 Windows Server 2012 R2
  MS16-116 Windows Vista Service Pack 2
  MS16-116 Windows Vista x64 Edition Service Pack 2

• Microsoft Windows Update for Vulnerabilities in Adobe Flash Player in Internet Explorer (MS16-117)

  Severity

  Urgent 5

  Qualys ID

  100296

  Vendor Reference

  MS16-117

  CVE Reference

  CVE-2016-4271, CVE-2016-4272, CVE-2016-4274, CVE-2016-4275, CVE-2016-4276, CVE-2016-4277, CVE-2016-4278, CVE-2016-4279, CVE-2016-4280, CVE-2016-4281, CVE-2016-4282, CVE-2016-4283, CVE-2016-4284, CVE-2016-4285, CVE-2016-4287, CVE-2016-6921, CVE-2016-6922, CVE-2016-6923, CVE-2016-6924, CVE-2016-6925, CVE-2016-6926, CVE-2016-6927, CVE-2016-6929, CVE-2016-6930, CVE-2016-6931, CVE-2016-6932

  CVSS Scores

  Base 9.3 / Temporal 8.1

  Description

  Microsoft released an update for Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.

  The update addresses the vulnerabilities described in Adobe Security bulletin APSB16-29.

  This security update is rated Critical for Adobe Flash Player in Internet Explorer 10, Internet Explorer 11 and Microsoft Edge.

  Consequence

  Successful exploitation of this vulnerability will allow an attacker to execute arbitrary code.

  Solution

  Customers are advised to view MS16-117 for instructions pertaining to the remediation of these vulnerabilities.

  Patches:
  The following are links for downloading patches to fix these vulnerabilities:
  MS16-117 Windows 8.1 for 32-bit Systems(Adobe Flash Player)
  MS16-117 Windows 8.1 for x64-based Systems(Adobe Flash Player)
  MS16-117 Windows Server 2012(Adobe Flash Player)
  MS16-117 Windows Server 2012 R2(Adobe Flash Player)

Access for Qualys Customers

Platforms and Platform Identification

Technical Support

For more information, customers may contact Qualys Technical Support.

About Qualys

The Enterprise TruRisk Platform and its integrated suite of security and compliance applications provides organizations of all sizes with a global view of their security and compliance solutions, while drastically reducing their total cost of ownership. Qualys solutions include: continuous monitoring, vulnerability management, policy compliance, PCI compliance, security assessment questionnaire, web application scanning, web application firewall, malware detection and SECURE Seal for security testing of web sites.