Microsoft Patch Tuesday, February 2016

February Patch Tuesday is here with double the number of vulnerabilities that were patched in January. In all there are thirteen bulletins issued this month patching 36 unique CVEs. Four of the bulletins are rated Critical. This includes 14 vulnerabilities patched in Internet Explorer and Microsoft Edge web browsers. The other two critical bulletins affect the Windows PDF library and Windows Journal. In each case a maliciously created file could trigger remote code execution in the user context of the victim opening the file.

The final nine bulletins are rated Important, but still include two potential remote code execution vulnerabilities that require local access or a local victim. One, MS16-014 affects Microsoft Windows directly through malicious DLL loading. The other affects MS Office where code execution can be triggered by getting a victim to open a malicious Office document.

Across the bulletins every supported version of Microsoft Windows is affected as well as many client applications like IE and Office. Time to get patching!

MS16-009
CVE-2016-0041, CVE-2016-0059, CVE-2016-0060, CVE-2016-0061, CVE-2016-0062, CVE-2016-0063, CVE-2016-0064, CVE-2016-0067, CVE-2016-0068, CVE-2016-0069, CVE-2016-0071, CVE-2016-0072, CVE-2016-0077
Critical
Cumulative Security Update for Internet Explorer

This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

This security update is rated Critical for Internet Explorer 9 (IE 9), and Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 9 (IE 9), Internet Explorer 10 (IE 10), and Internet Explorer 11 (IE 11) on affected Windows servers.

MS16-011
CVE-2016-0060, CVE-2016-0061, CVE-2016-0062, CVE-2016-0077, CVE-2016-0080, CVE-2016-0084
Critical
Cumulative Security Update for Microsoft Edge

This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

This security update is rated Critical for Microsoft Edge on Windows 10.

MS16-012
CVE-2016-0046, CVE-2016-0058
Critical
Security Update for Microsoft Windows PDF Library to Address Remote Code Execution

This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Microsoft Windows PDF Library improperly handles application programming interface (API) calls, which could allow an attacker to run arbitrary code on the user's system. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. However, an attacker would have no way to force users to download or open a malicious PDF document.

This security update is rated Critical for all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows 10.

MS16-013
CVE-2016-0038
Critical
Security Update to Windows Journal to Address Remote Code Execution

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted Journal file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for all supported editions of Windows Vista, Windows 7, Windows 8.1, and Windows 10, for all supported non-Itanium editions of Windows Server 2008 and Windows Server 2008 R2, and for all supported editions of Windows Server 2012 and Windows Server 2012 R2.

MS16-014
CVE-2016-0040, CVE-2016-0041, CVE-2016-0042, CVE-2016-0044, CVE-2016-0049
Important
Security update for Microsoft Windows to Address Remote Code Execution

This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow remote code execution if an attacker is able to log on to a target system and run a specially crafted application.

It addresses the vulnerabilities by:

• Correcting how the Windows kernel handles objects in memory
• Correcting how Windows validates input before loading DLL files
• Correcting how Microsoft Sync Framework validates input
• Adding an additional authentication check

This security update is rated Important for all supported releases of Microsoft Windows

MS16-015
CVE-2016-0022, CVE-2016-0039, CVE-2016-0052, CVE-2016-0053, CVE-2016-0054, CVE-2016-0055, CVE-2016-0056
Important
Security Update for Microsoft Office to Address Remote Code Execution

This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

See full Microsoft bulletin for affected versions of Microsoft Office.

MS16-016
CVE-2016-0051
Important
Security Update for WebDAV to Address Elevation of Privilege

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker uses the Microsoft Web Distributed Authoring and Versioning (WebDAV) client to send specifically crafted input to a server.

This security update is rated Important for Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2, and Moderate for Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.

MS16-017
CVE-2016-0036
Important
Security Update for Remote Desktop Display Driver to Address Elevation of Privilege

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an authenticated attacker logs on to the target system using RDP and sends specially crafted data over the connection. By default, RDP is not enabled on any Windows operating system. Systems that do not have RDP enabled are not at risk.

This security update is rated Important for all supported editions of Windows 7, Windows Server 2012, Window 8.1, Windows Server 2012 R2, and Windows 10.

MS16-018
CVE-2016-0048
Important
Security Update for Windows Kernel-Mode Driver to Address Elevation of Privilege

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application. The update addresses the vulnerability by correcting how the Windows Kernel-mode driver handles objects in memory.

This security update is rated Important for all supported editions of Windows. For more information, see the Affected Software section.

MS16-019
CVE-2016-0033, CVE-2016-0047
Important
Security Update for .NET Framework to Address Denial of Service

This security update resolves vulnerabilities in Microsoft .NET Framework. The more severe of the vulnerabilities could cause denial of service if an attacker inserts specially crafted XSLT into a client-side XML web part, causing the server to recursively compile XSLT transforms. The update addresses the vulnerabilities by correcting how Microsoft WinForms validates decoder results and by correcting how.NET Framework handles extensible stylesheet language transformations (XSLT).

This security update is rated Important for Microsoft .NET Framework 2.0 Service Pack 2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, and Microsoft .NET Framework 4.6.1 on affected releases of Microsoft Windows

MS16-020
CVE-2016-0037
Important
Security Update for Active Directory to Address Denial of Service

This security update resolves a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow denial of service if an attacker sends certain input data during forms-based authentication to an ADFS server, causing the server to become nonresponsive. The update addresses the vulnerability by adding additional verification checks in ADFS.

This security update is rated Important for ADFS 3.0 when installed on x64-based editions of Windows Server 2012 R2.

MS16-021
CVE-2016-0050
Important
Security Update for Network Policy Server RADIUS implementation to Address Denial of Service

This security update resolves a vulnerability in Microsoft Windows. The vulnerability could cause denial of service on a Network Policy Server (NPS) if an attacker sends specially crafted username strings to the NPS, which could prevent RADIUS authentication on the NPS. The update addresses the vulnerability by changing how NPS parses username queries when implementing RADIUS.

This security update is rated Important for all supported editions of Windows Server 2008 (excluding Itanium), and Windows Server 2008 R2 (excluding Itanium), and all supported editions of Windows Server 2012 and Windows Server 2012 R2. For more information, see the Affected Software section.