Latest Security Advisories & Notable Vulnerabilities

Microsoft addresses several vulnerabilities in its June batch of patches:

• MS08-067 | Vulnerability in Server Service Could Allow Remote Code Execution (958644)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in the Server service. The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request.



• MS09-050 | Vulnerabilities in SMBv2 Could Allow Remote Code Execution (975517)
  Risk Rating: Critical
  
  This security update resolves three vulnerabilities in Server Message Block Version 2 (SMBv2). The most severe of the vulnerabilities could allow remote code execution if an attacker sent a specially crafted SMB packet to a computer running the Server service.



• MS10-061 | Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in the Print Spooler service. The vulnerability could allow remote code execution if an attacker sends a specially crafted print request to a vulnerable system that has a print spooler interface exposed over RPC.



• MS14-068 | Vulnerability in Kerberos Could Allow Elevation of Privilege (3011780)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in Microsoft Windows Kerberos KDC that could allow an attacker to elevate unprivileged domain user account privileges to those of the domain administrator account. An attacker could use these elevated privileges to compromise any computer in the domain, including domain controllers.



• MS17-010 | Security Update for Microsoft Windows SMB Server (4013389)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.



• MS17-013 | Security Update for Microsoft Graphics Component (4013075)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows, Microsoft Office, Skype for Business, Microsoft Lync, and Microsoft Silverlight. The most severe of these vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document.



• CVE-2017-0176 | Remote Desktop Protocol Remote Code Execution Vulnerability (CVE-2017-0176 )
  Risk Rating: Critical
  
  A remote code execution vulnerability exists in Remote Desktop Protocol (RDP) if the RDP server has Smart Card authentication enabled. An attacker who successfully exploited this vulnerability could execute code on the target system.



• CVE-2017-0222| Internet Explorer Memory Corruption Vulnerability (CVE-2017-0222)
  Risk Rating: Critical
  
  A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user.



• CVE-2017-0231 | Microsoft Browser Spoofing Vulnerability
  Risk Rating: Critical
  
  This vulnerability exists in Internet Explorer 11 and Microsoft Edge browsers. The vulnerability lies in the rendering of SmartScreen Filter.



• CVE-2017-0267 - CVE-2017-0280 | Security Update for Microsoft Windows SMB (CVEs 2017-0267 through 2017-0280)
  Risk Rating: Critical
  
  Security updates exist in Microsoft Windows SMB. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted packets to a Microsoft Server Message Block 1.0 (SMBv1) server.



• CVE-2017-7269 | WebDAV Remote Code Execution Vulnerability (CVE-2017-7269)
  Risk Rating: Critical
  
  A vulnerability exists in IIS when WebDAV improperly handles objects in memory, which could allow an attacker to run arbitrary code on the user’s system. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user.



• CVE-2017-8461 | Windows RPC Remote Code Execution Vulnerability (CVE-2017-8461)
  Risk Rating: Critical
  
  A remote code execution vulnerability exists in RPC if the server has Routing and Remote Access enabled. An attacker who successfully exploited this vulnerability could execute code on the target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.



• CVE-2017-8464 | LNK Remote Code Execution Vulnerability (CVE-2017-8464)
  Risk Rating: Critical
  
  A remote code execution exists in Microsoft Windows that could allow remote code execution if the icon of a specially crafted shortcut is displayed. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user.



• CVE-2017-8487 | Windows olecnv32.dll Remote Code Execution Vulnerability (CVE-2017-8487)
  Risk Rating: Critical
  
  A remote code execution vulnerability exists when Microsoft Windows OLE fails to properly validate user input. An attacker could exploit the vulnerability to execute malicious code.



• CVE-2017-8543 | Windows Search Remote Code Execution Vulnerability (CVE-2017-8543)
  Risk Rating: Critical
  
  A remote code execution vulnerability exists when Windows Search handles objects in memory. An attacker who successfully exploited this vulnerability could take control of the affected system.



• CVE-2017-8552 | Win32k Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  An elevation of privilege vulnerability exists when the Windows kernel-mode driver fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.

Microsoft addresses several vulnerabilities in its May batch of patches:

• CVE-2017-0290 | Microsoft Malware Protection Engine Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This vulnerability allows attackers full access to a vulnerable system by exploiting Microsoft Malware Protection Engine's NScript component. It is a remote code execution vulnerability.



• CVE-2017-0158 | Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This vulnerability in the VBScript engine of specific Windows operating systems exists in the way it handles objects in Internet Explorer memory.



• CVE-2017-0261 | Microsoft Office Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This recmote code execution vulnerability that exists in Microsoft Office in the way it handles malformed graphics image.



• CVE-2017-0262 | Microsoft Office Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This recmote code execution vulnerability that exists in Microsoft Office in the way it handles malformed graphics image.



• CVE-2017-0064 | Internet Explorer Security Feature Bypass Vulnerability
  Risk Rating: Low
  
  This vulnerability exists in the way Internet Explorer allows bypass of Mixed Content warnings when loading unsecure content from HTTPS websites.



• CVE-2017-0222 | Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Moderate
  
  This vulnerability exists in the way Internet Explorer may incorrectly access objects in memory. It is a remote code execution vulnerability.



• CVE-2017-0226 | Internet Explorer Memory Corruption Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the way Internet Explorer may incorrectly access objects in memory. It is a remote code execution vulnerability.



• CVE-2017-0228 | Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This remote code execution vulnerability exists in the JavaScript engine's rendering of objects in memory in Microsoft Edge and Internet Explorer 11 browsers. It is a remote code execution vulnerability.



• CVE-2017-0231 | Microsoft Browser Spoofing Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in Internet Explorer 11 and Microsoft Edge browsers. The vulnerability lies in the rendering of SmartScreen Filter.



• CVE-2017-0238 | Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the Microsoft Edge browser's JavaScript scripting engine. The vulnerability lies in the way the engine handles objects in memory.

Microsoft addresses several vulnerabilities in its April batch of patches:

• CVE-2017-0160 | .NET Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This vulnerability exists in several .NET Framework versions. It happens when the .NET Framework version fails to validate input upon loading of libraries. It is a remote code execution vulnerability.



• CVE-2017-0158 | Scripting Engine Memory Corruption Vulnerability
  Risk Rating: Critical
  
  This vulnerability in the VBScript engine of specific Windows operating systems exists in the way it handles objects in Internet Explorer memory.



• CVE-2017-0166 | LDAP Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This vulnerability in LDAP exists in the calculation of request lengths. An attacker successfully exploiting this vulnerability can have elevated privileges on the vulnerable machine.



• CVE-2017-0058 | Win32k Information Disclosure Vulnerability
  Risk Rating: Important
  
  This vulnerability in the win32k component in specific Windows operating systems exists in its inability to handle kernel information properly.



• CVE-2017-0192 | ATMFD.dll Information Disclosure Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the Adobe Type Manager Font Driver library. It exists in the way it handles objects loaded in memory.



• CVE-2013-6629 | libjpeg Information Disclosure Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the libjpeg library. When successfully exploited, it may bypass the Address Space Layout Randomization (ASLR).



• CVE-2017-0195 | Microsoft Office XSS Elevation of Privilege Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the Office Web Apps server way of sanitizing specially crafted requests. Said vulnerability may be exploited a number of ways.



• CVE-2017-0106 | Microsoft Outlook Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This vulnerability exists in the way Microsoft Outlook parses specially crafted messages.



• CVE-2017-0204 | Microsoft Office Security Feature Bypass Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the way Microsoft Office parses file formats.



• CVE-2017-0199 | Microsoft Office Remote Code Execution Vulnerability
  Risk Rating: Important
  
  This vulnerability could allow remote code execution when successfully exploited. There are exploits in the wild found to be using this vulnerability.



• CVE-2017-0194 | Microsoft Office Memory Corruption Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the way Microsoft Office handles objects in the memory.



• CVE-2017-0197 | Office DLL Loading Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the way Microsoft Office validates dynamic link libraries loading.



• CVE-2017-0163 | Hyper-V Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This vulnerability exists in the way Windows Hyper-V Network Switch validates network traffic of a guest operating system.



• CVE-2017-0168 | Hyper-V Information Disclosure Vulnerability
  Risk Rating: Important
  
  This vulnerability exists in the way Windows Hyper-V Network Switch validates input of a guest operating system.



• CVE-2017-0180 | Hyper-V Remote Code Execution Vulnerability
  Risk Rating: Critical
  
  This vulnerability exists in the way Windows Hyper-V Network Switch validates network traffic of a guest operating system.

Microsoft addresses several vulnerabilities in its March batch of patches. More information are found in the Trend Micro Security Intelligence Blog.

• (MS17-006) Cumulative Security Update for Internet Explorer (4013073)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user.



• (MS17-007) Cumulative Security Update for Microsoft Edge (4013071)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Edge. These vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited these vulnerabilities could take control of an affected system.



• (MS17-008) Security Update for Windows Hyper-V (4013082)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an authenticated attacker on a guest operating system runs a specially crafted application that causes the Hyper-V host operating system to execute arbitrary code.



• (MS17-009) Security Update for Microsoft Windows PDF Library (4010319)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views specially crafted PDF content online or opens a specially crafted PDF document.



• (MS17-010) Security Update for Microsoft Windows SMB Server (4013389)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker sends specially crafted messages to a Microsoft Server Message Block 1.0 (SMBv1) server.



• (MS17-011) Security Update for Microsoft Uniscribe (4013076)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Windows Uniscribe. The most severe of these vulnerabilities could allow remote code execution if a user visits a specially crafted website or opens a specially crafted document.



• (MS17-012) Security Update for Microsoft Windows (4013078)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker runs a specially crafted application that connects to an iSNS Server and then issues malicious requests to the server.



• (MS17-013) Security Update for Microsoft Graphics Component (4013075)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows, Microsoft Office, Skype for Business, Microsoft Lync, and Microsoft Silverlight. The most severe of these vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document.



• (MS17-014) Security Update for Microsoft Office (4013241)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.



• (MS17-015) Security Update for Windows Kernel (3199720)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Exchange Outlook Web Access (OWA). The vulnerability could allow remote code execution in Exchange Server if an attacker sends an email with a specially crafted attachment to a vulnerable Exchange server.



• (MS17-016) Security Update for Windows IIS (4013074)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Internet Information Services (IIS). The vulnerability could allow elevation of privilege if a user clicks a specially crafted URL which is hosted by an affected Microsoft IIS server.



• (MS17-017) Security Update for Windows Kernel (4013081)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application.



• (MS17-018) Security Update for Windows Kernel-Mode Drivers (4013083)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that could exploit the vulnerabilities and take control of an affected system.



• (MS17-019) Security Update for Active Directory Federation Services (4010320)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow information disclosure if an attacker sends a specially crafted request to an ADFS server, allowing the attacker to read sensitive information about the target system.



• (MS17-020) Security Update for Windows DVD Maker (3208223)
  Risk Rating: Important
  
  This security update resolves an information disclosure vulnerability in Windows DVD Maker. The vulnerability could allow an attacker to obtain information to further compromise a target system.



• (MS17-021) Security Update for Windows DirectShow (4010318)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow an information disclosure if Windows DirectShow opens specially crafted media content that is hosted on a malicious website.



• (MS17-022) Security Update for Microsoft XML Core Services (4010321)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure if a user visits a malicious website. However, in all cases an attacker would have no way to force a user to click a specially crafted link. An attacker would have to convince a user to click the link, typically by way of an enticement in an email or Instant Messenger message.



• (MS17-023) Security Update for Adobe Flash Player (4014329))
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.

• (MS17-003) Security Update for Adobe Flash Player (3214628)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.



• (MS17-001) Security Update for Microsoft Edge (3214288)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Edge. This vulnerability could allow an elevation of privilege if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited this vulnerability could gain elevated permissions on the namespace directory of a vulnerable system and gain elevated privileges.



• (MS17-002) Security Update for Microsoft Office (3214291)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.



• (MS17-004) Security Update for Local Security Authority Subsystem Service (3216771) Risk Rating: Important
  
  A denial of service vulnerability exists in the way the Local Security Authority Subsystem Service (LSASS) handles authentication requests. An attacker who successfully exploited the vulnerability could cause a denial of service on the target system's LSASS service, which triggers an automatic reboot of the system..

• (MS16-144) Cumulative Security Update for Internet Explorer (3204059)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.



• (MS16-145) Cumulative Security Update for Microsoft Edge (3204062)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.



• (MS16-146) Security Update for Microsoft Graphics Component (3204066)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document.



• (MS16-147) Security Update for Microsoft Uniscribe (3204063) Risk Rating: Critical
  
  This security update resolves a vulnerability in Windows Uniscribe. The vulnerability could allow remote code execution if a user visits a specially crafted website or opens a specially crafted document.



• (MS16-148) Security Update for Microsoft Office (3204068)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.



• (MS16-149) Security Update for Microsoft Windows (3205655)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege if a locally authenticated attacker runs a specially crafted application.



• (MS16-150) Security Update for Secure Kernel Mode (3205642)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if a locally-authenticated attacker runs a specially crafted application on a targeted system.



• (MS16-151) Security Update for Windows Kernel-Mode Drivers (3205651)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that could exploit the vulnerabilities and take control of an affected system.



• (MS16-152) Security Update for Windows Kernel (3199709))
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure when the Windows kernel improperly handles objects in memory.



• (MS16-153) Security Update for Common Log File System Driver (3207328)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure when the Windows Common Log File System (CLFS) driver improperly handles objects in memory.



• (MS16-154) Security Update for Adobe Flash Player (3209498)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.



• (MS16-155) Security Update for .NET Framework (3205640)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft .NET 4.6.2 Framework’s Data Provider for SQL Server. A security vulnerability exists in Microsoft .NET Framework 4.6.2 that could allow an attacker to access information that is defended by the Always Encrypted feature.

• (MS16-129) Cumulative Security Update for Microsoft Edge (3199057)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.



• (MS16-130) Security Update for Microsoft Windows (3199172)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if a locally authenticated attacker runs a specially crafted application.



• (MS16-131) Security Update for Microsoft Video Control (3199151)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution when Microsoft Video Control fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.



• (MS16-132) Security Update for Microsoft Graphics Component (3199120)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of these could allow remote code execution on the vulnerable system.



• (MS16-133) Security Update for Microsoft Office (3199168)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file.



• (MS16-134) Security Update for Common Log File System Driver (3193706)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The vulnerability could allow elevation of privilege when the Windows Common Log File System (CLFS) driver improperly handles objects in memory.



• (MS16-135) Security Update for Windows Kernel-Mode Drivers (3199135)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow elevation of privilege.



• (MS16-137) Security Update for Windows Authentication Methods (3199173)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege.



• (MS16-138) Security Update to Microsoft Virtual Hard Disk Driver (3199647)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The Windows Virtual Hard Disk Driver improperly handles user access to certain files. An attacker could manipulate files in locations not intended to be available to the user by exploiting this vulnerability.



• (MS16-139) Security Update for Windows Kernel (3199720)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker runs a specially crafted application to access sensitive information.



• (MS16-140) Security Update for Boot Manager (3193479)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if a physically-present attacker installs an affected boot policy.



• (MS16-141) Security Update for Adobe Flash Player (3202790)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, Windows 10, and Windows Server 2016.



• (MS16-142) Cumulative Security Update for Internet Explorer (3198467)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.

• (MS16-118) Cumulative Security Update for Internet Explorer (3192887)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user, and thus install malicious code without restriction.



• (MS16-119) Cumulative Security Update for Microsoft Edge (3192890)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user.



• (MS16-120) Security Update for Microsoft Graphics Component (3192884)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows, Microsoft .NET Framework, Microsoft Office, Skype for Business, Silverlight, and Microsoft Lync. The most serious of these vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document.



• (MS16-121) Security Update for Microsoft Office (3194063)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Office. An Office RTF remote code execution vulnerability exists in Microsoft Office software when the Office software fails to properly handle RTF files.



• (MS16-122) Security Update for Microsoft Video Control (3195360)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if Microsoft Video Control fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.



• (MS16-123) Security Update for Windows Kernel-Mode Drivers (3192892)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that could exploit the vulnerabilities and take control of an affected system.



• (MS16-124) Security Update for Windows Registry (3193227)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker can access sensitive registry information.



• (MS16-125) Security Update for Diagnostics Hub (3193229)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.



• (MS16-126) Security Update for Microsoft Internet Messaging API (3196067)
  Risk Rating: Moderate
  
  This security update resolves a vulnerability in Microsoft Windows. An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory.



• (MS16-127) (Security Update for Adobe Flash Player (3194343) Security Update for Windows Secure Kernel Mode (3185876)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.

• (MS16-104) Cumulative Security Update for Internet Explorer (3183038)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Internet Explorer, the most severe of which could allow remote code execution. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user.



• (MS16-105) Cumulative Security Update for Microsoft Edge (3183043)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Edge, the most severe of which could allow remote code execution. An attacker who successfully exploits these vulnerabilities could gain the same user rights as the current user.



• (MS16-106) Security Update for Microsoft Graphics Component (3185848)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if a user visits a specially crafted website hosted by an attacker.



• (MS16-107) Security Update for Microsoft Office (3185852)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Office, the more severe of which could allow remote code execution.



• (MS16-108) Security Update for Microsoft Exchange Server (3185883)
  Risk Rating: Critical
  
  This security update resolves a vulnerabilities in Microsoft Exchange Server, the most severe of which could allow remote code execution in certain Oracle Outside In libraries built into Exchange server.



• (MS16-109) Security Update for Silverlight (3182373)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Silverlight that could allow remote code execution. The vulnerability is exploited when a user visits a compromised website that contains a specially crafted Silverlight application.



• (MS16-110) Security Update for Windows (3178467)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows, the more severe of which could allow remote code execution if an attacker runs a specialy crafted request to exploit it.



• (MS16-111) Security Update for Windows Kernel (3186973)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows. When exploited, an attacker could gain the same rights as the currently logged on user.



• (MS16-112) Security Update for Windows Lock Screen (3178469)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows that could allow elevation of privilege.



• (MS16-113) Security Update for Windows Secure Kernel Mode (3185876)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows that could allow information disclosure. The vulnerability lies in the improper handling of objects in memory by the Windows Secure Kernel Mode.



• (MS16-114) Security Update for SMBv1 Server (3185879)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows that could allow remote code execution in certain versions of the operating system. The attacker sends specially crafted packets to a vulnerable SMBv1 Server.



• (MS16-115) Security Update for Microsoft Windows PDF Library (3188733)
  Risk Rating: Important
  
  This security update resolves several vulnerabilities in Microsoft Windows that could allow information disclosure. An attacker must host a specially crafted PDF document or content online to exploit these vulnerablities.



• (MS16-116) Security Update in OLE Automation for VBScript Scripting Engine (3188724)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in Microsoft Windows that could allow remote code execution. This bulletin requires installation of two updates prior to installing the update in this bulletin.



• (MS16-117) Security Update for Adobe Flash Player (3188128)
  Risk Rating: Critical
  
  This security update resolves several vulnerabilities in Adobe Flash Player installed on certain versions of Microsoft Windows operating systems.

• (MS16-095) Cumulative Security Update for Internet Explorer (3177356)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Internet Explorer, the most severe of which could allow remote code execution. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user.



• (MS16-096) Cumulative Security Update for Microsoft Edge (3177358)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Edge, the most severe of which could allow remote code execution. An attacker who successfully exploits these vulnerabilities could gain the same user rights as the current user.



• (MS16-097) Security Update for Microsoft Graphics Component (3177393)
  Risk Rating: Critical
  
  This security update resolves vulnerabilities in Microsoft Windows, Ms Office, Skype for Business, and MS Lync. The vulnerabilities could allow remote code execution if a user visits a specially crafted website hosted by an attacker.



• (MS16-098) Security Update for Windows Kernel-Mode Drivers (3178466)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows, the more severe of which could allow elevation of privilege.



• (MS16-099) Security Update for Microsoft Office (3177451)
  Risk Rating: Critical
  
  This security update resolves a vulnerabilities in Microsoft Office, the most severe of which could allow remote code execution. An attacker must persuade a user to open a specially crafted Microsoft Office file to exploit these vulnerabilities.



• (MS16-100) Security Update for Secure Boot (3179577)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows that could allow the bypass of Windows embedded security features.



• (MS16-101) Security Update for Windows Authentication Methods (3178465)
  Risk Rating: Important
  
  This security update resolves vulnerabilities in Microsoft Windows, the more severe of which could allow elevation of privilege if an attacker runs a specific application to exploit it.



• (MS16-102) Security Update for Microsoft Windows PDF Library (3182248)
  Risk Rating: Critical
  
  This security update resolves a vulnerability in Microsoft Windows when viewing online PDF content. When exploited, an attacker could gain the same rights as the currently logged on user.



• (MS16-103) Security Update for ActiveSyncProvider (3182332)
  Risk Rating: Important
  
  This security update resolves a vulnerability in Microsoft Windows that could allow information disclosure.