Today is August's Patch and with only 9 bulletins with 27 unique CVEs it's one of the lightest months in recent history. Four of the bulletins are rated Critical with the other five are rated as Important. Internet Explorer and Edge web browsers are back with eight and nine vulnerabilities each (many are duplicates shared between the two browsers). The other two critical bulletins cover a remote code execution vulnerability that could be exploited through how the Windows font library handles embedded fonts in documents, webpages and Lync/Skype messages as well as a remote code execution vulnerability in the Windows PDF Library.
MS16-095
CVE-2016-3288, CVE-2016-3289, CVE-2016-3290, CVE-2016-3293, CVE-2016-3321, CVE-2016-3322, CVE-2016-3326, CVE-2016-3327, CVE-2016-3329
Critical
Cumulative Security Update for Internet Explorer
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
This security update is rated Critical for Internet Explorer 9 (IE 9), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers
MS16-096
CVE-2016-3289, CVE-2016-3293, CVE-2016-3296, CVE-2016-3319, CVE-2016-3322, CVE-2016-3326, CVE-2016-3327, CVE-2016-3329
Critical
Cumulative Security Update for Microsoft Edge
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.
This security update is rated Critical for Microsoft Edge on Windows 10.
MS16-097
CVE-2016-3301, CVE-2016-3303, CVE-2016-3304
Critical
Security Update for Microsoft Graphics Component
This security update resolves vulnerabilities in Microsoft Windows, Microsoft Office, Skype for Business, and Microsoft Lync. The vulnerabilities could allow remote code execution if a user either visits a specially crafted website or opens a specially crafted document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. The security update addresses the vulnerabilities by correcting how the Windows font library handles embedded fonts.
This security update is rated Critical for all supported releases of Microsoft Windows, affected editions of Microsoft Office 2007 and Microsoft Office 2010 and affected editions of Skype for Business 2016, Microsoft Lync 2013, and Microsoft Lync 2010.
MS16-098
CVE-2016-3308, CVE-2016-3309, CVE-2016-3310, CVE-2016-3311
Important
Security Update for Kernel-Mode Drivers
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that could exploit the vulnerabilities and take control of an affected system.
This security update is rated Important for all supported releases of Windows
MS16-099
CVE-2016-3313, CVE-2016-3315, CVE-2016-3316, CVE-2016-3317, CVE-2016-3318
Important
Security Update for Office
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
See full Microsoft bulletin for affected versions of Microsoft Office.
MS16-100
CVE-2016-3320
Important
Security Update for Secure Boot
This security update resolves a vulnerability in Microsoft Windows. A security feature bypass vulnerability exists when Windows Secure Boot improperly loads a boot manager that is affected by the vulnerability. An attacker who successfully exploited this vulnerability could disable code integrity checks, allowing test-signed executables and drivers to be loaded onto a target device. Furthermore, the attacker could bypass Secure Boot Integrity Validation for BitLocker and Device Encryption security features. To exploit the vulnerability, an attacker who has gained administrative privileges or who has physical access to a target device could install an affected boot manager.
The security update addresses the vulnerability by blacklisting affected boot managers. This security update is rated Important for all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.
MS16-101
CVE-2016-3237, CVE-2016-3300
Important
Security Update for Windows Authentication Methods
This security update resolves multiple vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker runs a specially crafted application on a domain-joined system.
This security update is rated Important for all supported releases of Microsoft Windows.
MS16-102
CVE-2016-3319
Critical
Security Update for Microsoft Windows PDF Library
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views specially crafted PDF content online or opens a specially crafted PDF document. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
This security update is rated Critical for all supported editions of Windows 8.1, Windows Server 2012, Windows RT 8.1, Windows Server 2012 R2, and Windows 10.
MS16-103
CVE-2016-3312
Important
Security Update for ActiveSyncProvider
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure when Universal Outlook fails to establish a secure connection.
This security update is rated Important for all supported editions of Windows 10.
