Security Alert (A16-07-01): Multiple Vulnerabilities in Microsoft Products (July 2016)

Description:

Microsoft has released 11 security bulletins listed below addressing multiple vulnerabilities which affect several Microsoft products or components:

MS16-084 Cumulative Security Update for Internet Explorer
MS16-085 Cumulative Security Update for Microsoft Edge
MS16-086 Cumulative Security Update for JScript and VBScript
MS16-087 Security Update for Windows Print Spooler Components
MS16-088 Security Update for Microsoft Office
MS16-089 Security Update for Windows Secure Kernel Mode
MS16-090 Security Update for Windows Kernel-Mode Drivers
MS16-091 Security Update for .NET Framework
MS16-092 Security Update for Windows Kernel
MS16-093 Security Update for Adobe Flash Player
MS16-094 Security Update for Secure Boot

Affected Systems:

• Microsoft Edge
• Microsoft Internet Explorer 9, 10, 11
• Microsoft Office 2007, 2010, 2013, 2013 RT, 2016, Office for Mac 2011, 2016
• Microsoft Office Compatibility Pack, Word Viewer, Excel Viewer
• Microsoft Office Online Server
• Microsoft Office Web Apps 2010, 2013
• Microsoft SharePoint Server 2010, 2013, 2016
• Microsoft Windows Vista, 7, 8.1, RT 8.1, 10
• Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2

A complete list of the affected products can be found in the section "Affected Software" in the Microsoft security bulletin summary available at:

https://technet.microsoft.com/library/security/ms16-jul

Impact:

Depending on the vulnerability exploited, a successful attack could lead to arbitrary code execution, denial-of-service condition, elevation of privilege, security restrictions bypass and information disclosure.

Recommendation:

Patches for affected products are available from the Microsoft Update website. Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

• Microsoft Update
  http://update.microsoft.com/microsoftupdate
  
  

If any problem is encountered during the patch installation via automated methods, patches for various affected systems can also be downloaded individually from the "Affected and Non-Affected Software" section of the corresponding Microsoft Security Advisory and Bulletins which can be accessed from the URL(s) listed in the "More Information" section of this Security Alert.

More Information:

https://technet.microsoft.com/en-us/library/security/ms16-jul
https://technet.microsoft.com/library/security/MS16-084
https://technet.microsoft.com/library/security/MS16-085
https://technet.microsoft.com/library/security/MS16-086
https://technet.microsoft.com/library/security/MS16-087
https://technet.microsoft.com/library/security/MS16-088
https://technet.microsoft.com/library/security/MS16-089
https://technet.microsoft.com/library/security/MS16-090
https://technet.microsoft.com/library/security/MS16-091
https://technet.microsoft.com/library/security/MS16-092
https://technet.microsoft.com/library/security/MS16-093
https://technet.microsoft.com/library/security/MS16-094
https://www.us-cert.gov/ncas/current-activity/2016/07/12/Microsoft-Releases-Security-Updates
https://www.hkcert.org/my_url/en/alert/16071301
https://www.hkcert.org/my_url/en/alert/16071302
https://www.hkcert.org/my_url/en/alert/16071303
https://www.hkcert.org/my_url/en/alert/16071304
https://www.hkcert.org/my_url/en/alert/16071305
https://www.hkcert.org/my_url/en/alert/16071306
https://www.hkcert.org/my_url/en/alert/16071307
https://www.hkcert.org/my_url/en/alert/16071308
https://www.hkcert.org/my_url/en/alert/16071309
https://www.hkcert.org/my_url/en/alert/16071310
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3204
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3238 (to CVE-2016-3246)
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3248 (to CVE-2016-3252)
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3254 (to CVE-2016-3256)
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3258 (to CVE-2016-3261)
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3264 (to CVE-2016-3265)
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3269
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3271 (to CVE-2016-3274)
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3276 (to CVE-2016-3284)
http://cve.mitre.org/cgi-bin/cvename.cgi?name= CVE-2016-3286 (to CVE-2016-3287)