October's Patch Tuesday is upon us and with only six bulletins, it's one of lightest releases we've seen. The six bulletins are split down the center with three rated as Critical and three rated as Important. This release addresses a total of 30 CVEs half of which are patched in Internet Explorer. The other two Critical bulletins patch remote code execution vulnerabilities in the Microsoft VBScript and Jscript scripting engines as well as the Microsoft Windows Shell. The Windows Shell bulletin patches a use-after-free vulnerability that is triggered by having a victim open a maliciously crafted windows toolbar object. The remote code execution would occur in the user context of the victim's user account. Hopefully light months like this one will be a trend for the rest of the year and maybe even into 2016.
MS15-106
CVE-2015-2482, CVE-2015-6042, CVE-2015-6044, CVE-2015-6045, CVE-2015-6046, CVE-2015-6047, CVE-2015-6048, CVE-2015-6049, CVE-2015-6050, CVE-2015-6051, CVE-2015-6052, CVE-2015-6053, CVE-2015-6055, CVE-2015-6056, CVE-2015-6059
Critical
Cumulative Security Update for Internet Explorer
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
This security update is rated Critical for Internet Explorer 7 (IE 7) through Internet Explorer 11 (IE 11) on affected Windows clients, and Moderate for Internet Explorer 7 (IE 7) through Internet Explorer 11 (IE 11) on affected Windows servers.
MS15-107
CVE-2015-6057, CVE-2015-6058
Important
Cumulative Security Update for Microsoft Edge
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow information disclosure if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
This security update is rated Important for Microsoft Edge on Windows 10.
MS15-108
CVE-2015-2482, CVE-2015-6052, CVE-2015-6055, CVE-2015-6059
Critical
Security Update for JScript and VBScript to Address Potential Remote Code Execution
This security update resolves vulnerabilities in the VBScript and JScript scripting engines in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker hosts a specially crafted website that is designed to exploit the vulnerabilities through Internet Explorer (or leverages a compromised website or a website that accepts or hosts user-provided content or advertisements) and then convinces a user to view the website. An attacker could also embed an ActiveX control marked "safe for initialization" in an application or Microsoft Office document that uses the IE rendering engine to direct the user to the specially crafted website.
An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user and, if the current user is logged on with administrative user rights, the attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
This security update is rated Critical for affected versions of the JScript and VBScript scripting engines on supported editions of Windows Vista, Windows Server 2008, and Server Core installations of Windows Server 2008 R2.
MS15-109
CVE-2015-2515, CVE-2015-2548
Critical
Security Update for Windows Shell to Address Remote Code Execution
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if a user opens a specially crafted toolbar object in Windows or an attacker convinces a user to view specially crafted content online.
This security update is rated Critical for all supported releases of Microsoft Windows
MS15-110
CVE-2015-2555, CVE-2015-2556, CVE-2015-2557, CVE-2015-2558, CVE-2015-6037, CVE-2015-6039
Important
Security Updates for Microsoft Office to Address Remote Code Execution
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.
This security update is rated Important for all supported editions of the following software:
• Microsoft Excel 2007, Microsoft Visio 2007
• Microsoft Excel 2010, Microsoft Visio 2010
• Microsoft Excel 2013, Microsoft Excel 2013 RT
• Microsoft Excel 2016
• Microsoft Excel for Mac 2011
• Microsoft Excel 2016 for Mac
• Microsoft Excel Viewer, Microsoft Office Compatibility Pack
• Excel Services on Microsoft SharePoint Server 2007
• Excel Services on Microsoft SharePoint Server 2010, Microsoft Web App 2010, Microsoft Excel Web App 2010
• Excel Services on Microsoft SharePoint Server 2013, Microsoft Office Web Apps Server 2013
• Microsoft SharePoint Server 2007
• Microsoft SharePoint Server 2010
• Microsoft SharePoint Server 2013, Microsoft SharePoint Foundation 2013
MS15-111
CVE-2015-2549, CVE-2015-2550, CVE-2015-2552, CVE-2015-2553, CVE-2015-2554
Important
Security Update for Windows Kernel to Address Elevation of Privilege
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
This security update is rated Important for all supported releases of Microsoft Windows.
