Revision Note: V1.0 (November 10, 2015): Advisory published.
Summary: Microsoft is announcing the availability of a security update for Windows Hyper-V to protect against a denial of service condition that can be triggered with certain central processing unit (CPU) chipsets. Although the weakness resides in the chipset, Microsoft is issuing this security update to protect customers. The update prevents guests on a Hyper-V system from triggering a weakness in the CPU that could allow instructions from a Hyper-V guest to place its Hyper-V host’s CPU into an unresponsive state, leading to a denial of service condition for the guest operating systems running on the affected host. Successful exploitation of the CPU weakness would require kernel-mode code execution privileges on the guest operating system.
Category Archives: Microsft
Microsoft
MS15-122 – Important: Security Update for Kerberos to Address Security Feature Bypass (3105256) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (November 10, 2015): Bulletin published.
Summary: This security update resolves a security feature bypass in Microsoft Windows. An attacker could bypass Kerberos authentication on a target machine and decrypt drives protected by BitLocker. The bypass can be exploited only if the target system has BitLocker enabled without a PIN or USB key.
MS15-NOV – Microsoft Security Bulletin Summary for November 2015 – Version: 1.0
Revision Note: V1.0 (November 10, 2015): Bulletin Summary published.
Summary: This bulletin summary lists security bulletins released for November 2015.
MS15-116 – Important: Security Update for Microsoft Office to Address Remote Code Execution (3104540) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (November 10, 2015): Bulletin published.
Summary: This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS15-123 – Important: Security Update for Skype for Business and Microsoft Lync to Address Information Disclosure (3105872) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (November 10, 2015): Bulletin published.
Summary: This security update resolves a vulnerability in Skype for Business and Microsoft Lync. The vulnerability could allow information disclosure if an attacker invites a target user to an instant message session and then sends that user a message containing specially crafted JavaScript content.
MS15-108 – Critical: Security Update for JScript and VBScript to Address Remote Code Execution (3089659) – Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (October 13, 2015): Bulletin published.
Summary: This security update resolves vulnerabilities in the VBScript and JScript scripting engines in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker hosts a specially crafted website that is designed to exploit the vulnerabilities through Internet Explorer (or leverages a compromised website or a website that accepts or hosts user-provided content or advertisements) and then convinces a user to view the website. An attacker could also embed an ActiveX control marked “safe for initialization” in an application or Microsoft Office document that uses the IE rendering engine to direct the user to the specially crafted website.
MS15-111 – Important: Security Update for Windows Kernel to Address Elevation of Privilege (3096447) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (October 13, 2015): Bulletin published.
Summary: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
MS15-110 – Important: Security Updates for Microsoft Office to Address Remote Code Execution (3096440) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (October 13, 2015): Bulletin published.
Summary: This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS15-106 – Critical: Cumulative Security Update for Internet Explorer (3096441) – Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (October 13, 2015): Bulletin published.
Summary: This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS15-OCT – Microsoft Security Bulletin Summary for October 2015 – Version: 1.0
Revision Note: V1.0 (October 13, 2015): Bulletin Summary published.
Summary: This bulletin summary lists security bulletins released for October 2015.