Severity Rating: Important
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could cause denial of service on a Network Policy Server (NPS) if an attacker sends specially crafted username strings to the NPS, which could prevent RADIUS authentication on the NPS.
Category Archives: Microsft
Microsoft
MS16-009 – Critical: Cumulative Security Update for Internet Explorer (3134220) – Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves vulnerabilities in Internet Explorer. The more severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
MS16-013 – Critical: Security Update for Windows Journal to Address Remote Code Execution (3134811) – Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted Journal file. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
MS16-018 – Important: Security Update for Windows Kernel-Mode Drivers to Address Elevation of Privilege (3136082) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (February 9, 2016): Click here to enter text.
Summary: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker convinces a user to visit a malicious website.
MS16-019 – Important: Security Update for .NET Framework to Address Denial of Service (3137893) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves vulnerabilities in Microsoft .NET Framework. The more severe of the vulnerabilities could cause denial of service if an attacker insert specially crafted XSLT into a client-side XML web part, causing the server to recursively compile XSLT transforms.
MS16-011 – Critical: Cumulative Security Update for Microsoft Edge (3134225) – Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves vulnerabilities in Microsoft Edge. The vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
MS16-020 – Important: Security Update for Active Directory Federation Services to Address Denial of Service (3134222) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves a vulnerability in Active Directory Federation Services (ADFS). The vulnerability could allow denial of service if an attacker sends certain input data during forms-based authentication to an ADFS Server, causing the server to become nonresponsive.
MS16-016 – Important: Security Update for WebDAV to Address Elevation of Privilege (3136041) – Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker uses the Microsoft Web Distributed Authoring and Versioning (WebDAV) client to improperly validate input.
3137909 – Vulnerabilities in ASP.NET Templates Could Allow Tampering – Version: 1.0
Revision Note: V1.0 (February 9, 2016): Advisory published.
Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in the public versions of Visual Studio 2013, Visual Studio 2015, ASP.NET MVC5, and ASP.NET MVC6. This advisory also provides guidance on what developers can do to help ensure that the controls and components that they have built are not subject to the vulnerability.
MS16-012 – Critical: Security Update for Microsoft Windows PDF Library to Address Remote Code Execution (3138938) – Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (February 9, 2016): Bulletin published.
Summary: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Microsoft Windows PDF Library improperly handles application programming interface (API) calls, which could allow an attacker to run arbitrary code on the user’s system. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. However, an attacker would have no way to force users to download or open a malicious PDF document.