Security Alert (A16-04-02): Multiple Vulnerabilities in Microsoft Products (April 2016)

Description:

Microsoft has released 13 security bulletins listed below addressing multiple vulnerabilities which affect several Microsoft products or components:

MS16-037    Cumulative Security Update for Internet Explorer
MS16-038    Cumulative Security Update for Microsoft Edge
MS16-039    Security Update for Microsoft Graphics Component
MS16-040    Security Update for Microsoft XML Core Services
MS16-041    Security Update for .NET Framework
MS16-042    Security Update for Microsoft Office
MS16-044    Security Update for Windows OLE
MS16-045    Security Update for Windows Hyper-V
MS16-046    Security Update for Secondary Logon
MS16-047    Security Update for SAM and LSAD Remote Protocols
MS16-048    Security Update for CSRSS
MS16-049    Security Update for HTTP.sys
MS16-050    Security Update for Adobe Flash Player

Affected Systems:

• Microsoft .NET Framework 4.6, 4.6.1
• Microsoft Edge
• Microsoft Internet Explorer 9, 10, 11
• Microsoft Live Meeting 2007 Console
• Microsoft Lync 2010, 2013
• Microsoft Office 2007, 2010, 2013, 2013 RT, 2016, Office for Mac 2011, 2016
• Microsoft Office Compatibility Pack, Excel Viewer, Word Viewer
• Microsoft Office Web Apps 2010, 2013
• Microsoft SharePoint Server 2007, 2010, 2013
• Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2
• Microsoft Windows Vista, 7, 8.1, RT 8.1, 10
• Microsoft XML Core Services 3.0
• Skype for Business 2016

A complete list of the affected products can be found in the section "Affected Software" in the Microsoft security bulletin summary available at:

https://technet.microsoft.com/library/security/ms16-apr

Impact:

Depending on the vulnerability exploited, a successful attack could lead to arbitrary code execution, denial-of-service condition, elevation of privilege, security restrictions bypass and information disclosure.

Recommendation:

Patches for affected products are available from the Microsoft Update website. Users of affected systems should follow the recommendations provided by the product vendor and take immediate actions to mitigate the risk.

• Microsoft Update
  http://update.microsoft.com/microsoftupdate

If any problem is encountered during the patch installation via automated methods, patches for various affected systems can also be downloaded individually from the "Affected and Non-Affected Software" section of the corresponding Microsoft Security Advisory and Bulletins which can be accessed from the URL(s) listed in the "More Information" section of this Security Alert.

More Information:

https://technet.microsoft.com/en-us/library/security/ms16-apr
https://technet.microsoft.com/library/security/MS16-037
https://technet.microsoft.com/library/security/MS16-038
https://technet.microsoft.com/library/security/MS16-039
https://technet.microsoft.com/library/security/MS16-040
https://technet.microsoft.com/library/security/MS16-041
https://technet.microsoft.com/library/security/MS16-042
https://technet.microsoft.com/library/security/MS16-044
https://technet.microsoft.com/library/security/MS16-045
https://technet.microsoft.com/library/security/MS16-046
https://technet.microsoft.com/library/security/MS16-047
https://technet.microsoft.com/library/security/MS16-048
https://technet.microsoft.com/library/security/MS16-049
https://technet.microsoft.com/library/security/MS16-050
https://www.hkcert.org/my_url/en/alert/16041301 (to 16041312)
https://www.us-cert.gov/ncas/current-activity/2016/04/12/Microsoft-Releases-April-2016-Security-Bulletin
http://www.kb.cert.org/vuls/id/813296
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0088 (to CVE-2016-0090)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0122
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0127 (to CVE-2016-0128)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0135 (to CVE-2016-0136)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0139
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0143
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0145
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0147 (to CVE-2016-0148)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0150 (to CVE-2016-0151)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0153 (to CVE-2016-0162)
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0164 (to CVE-2016-0167)