For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA Windows GPU Display Driver R340 before 342.00, R367 before 369.59, and R375 before 375.63 contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape ID 0x7000170 where the size of an input buffer is not validated, leading to denial of service or potential escalation of privileges.
Monthly Archives: November 2016
CVE-2016-8812
For the NVIDIA Quadro, NVS, and GeForce products, NVIDIA GeForce Experience R340 before GFE 2.11.4.125 and R375 before GFE 3.1.0.52 contains a vulnerability in the kernel mode layer (nvstreamkms.sys) allowing a user to cause a stack buffer overflow with specially crafted executable paths, leading to a denial of service or escalation of privileges.
Microsoft Releases Security Updates
Original release date: November 08, 2016
Microsoft has released 14 updates to address multiple vulnerabilities in Microsoft software. A remote attacker could exploit some of these vulnerabilities to take control of an affected system.
Users and administrators are encouraged to review Microsoft Security Bulletins MS16-129 through MS16-142 and apply the necessary updates.
This product is provided subject to this Notification and this Privacy & Use policy.
Microsoft Patches Zero Day Disclosed by Google
Microsoft released 14 security bulletins today, six rated critical. Among the fixes is a patch for a Windows kernel zero-day vulnerability disclosed by Google that was being used in attacks by the Sofacy APT gang.
Google Releases Supplemental Patch for Dirty Cow Vulnerability
Google’s November Android Security Bulletin patched 15 critical vulnerabilities, but only a supplemental patch for the Dirty Cow Linux vulnerability.
MS16-NOV – Microsoft Security Bulletin Summary for November 2016 – Version: 1.0
Revision Note: V1.0 (November 8, 2016): Bulletin published
Summary: This bulletin summary lists security bulletins released for November 2016.
MS16-131 – Critical: Security Update for Microsoft Video Control (3199151) – Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (November 8, 2016): Bulletin published.
Summary: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution when Microsoft Video Control fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. However, an attacker must first convince a user to open either a specially crafted file or a program from either a webpage or an email message.
MS16-133 – Important: Security Update for Microsoft Office (3199168) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (November 8, 2016): Bulletin published
Summary: This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-139 – Important: Security Update for Windows Kernel (3199720) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (November 8, 2016): Bulletin published.
Summary: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker runs a specially crafted application to access sensitive information. A locally authenticated attacker could attempt to exploit this vulnerability by running a specially crafted application. An attacker can gain access to information not intended to be available to the user by using this method.
MS16-136 – Important: Security Update for SQL Server (3199641) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (November 8, 2016): Bulletin Published.
Summary: This security update resolves vulnerabilities in Microsoft SQL Server. The most severe vulnerabilities could allow an attacker could to gain elevated privileges that could be used to view, change, or delete data; or create new accounts. The security update addresses these most severe vulnerabilities by correcting how SQL Server handles pointer casting.