Wednesday, July 13, 2016

Feedly:Security Intelligence | TrendLab.... July 2016 Patch Tuesday Releases 11 Security Bulletins; Adobe Fixes ‘Critical’ Flaws in Flash Player



from Security Intelligence | TrendLab...

Microsoft has rolled out eleven security updates for this month’s Patch Tuesday.  Six are tagged as ‘Critical’ while the rest are rated as ‘Important.’ Three of the critical security bulletins address vulnerabilities in Internet Explorer (MS16-084), Microsoft Edge (MS16-085), and JScript and VBScript scripting engines in Microsoft Windows (MS16-086). All three flaws can allow remote code execution when successfully exploited via a specially crafted website/webpage.  Moreover, two of these critical bulletins are cumulative security updates for Windows web browsers (Internet Explorer and Microsoft Edge), which are part of every Patch Tuesday.

Another notable security bulletin for this month’s cycle is MS16-088, which fixes critical vulnerabilities in Microsoft Office and also leads to remote code execution when successfully exploited. Meanwhile, Adobe has also released security patches (APSB16-25) for 52 critical vulnerabilities found in Adobe Flash Player.  The said flaws can allow an attacker to “take control of the affected system.” APSB16-24 fixes a vulnerability in Adobe XMP Toolkit for Java  (CVE-2016-4216) that could potentially  “lead to information disclosure.”  In addition, Adobe also updated their bulletin, APSB16-26 to address vulnerabilities in Adobe Acrobat and Reader.

Trend Micro researchers discovered and reported these vulnerabilities to Microsoft:

The following vulnerabilities were disclosed via Trend Micro’s Zero Day Initiative (ZDI):

These are the vulnerabilities reported in Adobe through Trend Micro’s ZDI:

Users are highly advised to update their systems with the latest patches to protect these from possible exploits.

Trend Micro solutions

Trend Micro Deep Security and Vulnerability Protection protect user systems from any threats that may target these Microsoft vulnerabilities via the following DPI rules:

  • 1007716-Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2016-3240)
  • 1007717-Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2016-3241)
  • 1007718-Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2016-3243)
  • 1007720-Microsoft Internet Explorer Information Disclosure Vulnerability (CVE-2016-3261)
  • 1007721-Microsoft Internet Explorer And Edge Spoofing Vulnerability (CVE-2016-3276)
  • 1007722-Microsoft Internet Explorer And Edge Spoofing Vulnerability (CVE-2016-3274)
  • 1007723-Microsoft Internet Explorer And Edge Scripting Engine Memory Corruption Vulnerability (CVE-2016-3259)
  • 1007724-Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2016-3242)
  • 1007725-Microsoft Internet Explorer And Edge Information Disclosure Vulnerability (CVE-2016-3277)
  • 1007726-Microsoft Edge Security Feature Bypass Vulnerability (CVE-2016-3244)
  • 1007727-Microsoft Edge Memory Corruption Vulnerability (CVE-2016-3246)
  • 1007729-Microsoft Edge Scripting Engine Information Disclosure Vulnerability (CVE-2016-3271)
  • 1007731-Microsoft Office Remote Code Execution Vulnerability (CVE-2016-3279)
  • 1007732-Microsoft Office Memory Corruption Vulnerability (CVE-2016-3280)
  • 1007733-Microsoft Office Memory Corruption Vulnerability (CVE-2016-3281)
  • 1007734-Microsoft Office Memory Corruption Vulnerability (CVE-2016-3282)
  • 1007735-Microsoft Office Memory Corruption Vulnerability (CVE-2016-3283)
  • 1007736-Microsoft Office Memory Corruption Vulnerability (CVE-2016-3284)

Post from: Trendlabs Security Intelligence Blog - by Trend Micro

July 2016 Patch Tuesday Releases 11 Security Bulletins; Adobe Fixes ‘Critical’ Flaws in Flash Player

Web Analytics