Advisories

CERT-In Advisory CIAD-2016-0082

Multiple Vulnerabilities in Microsoft Products

Original Issue Date: December 19, 2016

Software Affected

Windows 7 for 32-bit and x64-based Systems SP1
Windows Vista x64 Edition SP2
Windows Server 2008 for 32-bit,x64-based & Itanium-based Systems SP2
Windows Server 2008 R2 for x64-based and Itanium-based Systems SP1
Windows 8.1 for 32-bit and x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT 8.1
Windows 10 for 32-bit and x64-based Systems
Windows 10 Version 1511 for 32-bit and x64-based Systems
Windows 10 Version 1607 for 32-bit and x64-based Systems
Windows Server 2016 for x64-based Systems
Microsoft Excel 2007 SP3
Microsoft Office 2010 SP2 (32-bit editions & 64-bit editions)
Microsoft Excel 2013 SP1 (32-bit editions & 64-bit editions)
Microsoft Excel 2013 RT SP1
Microsoft Excel 2016 (32-bit editions & 64-bit editions)
Microsoft Office Compatibility Pack SP3
Microsoft Excel Viewer
Microsoft Word Viewer
Microsoft Publisher 2010 SP2 (32-bit editions & 64-bit editions)
Microsoft Excel for Mac 2011
Microsoft Word for Mac 2011
Microsoft Excel 2016 for Mac
Microsoft Office 2016 for Mac
Microsoft Auto Updater for Mac
Excel Services on Microsoft SharePoint Server 2007 SP3 (32-bit editions & 64-bit editions)
Excel Services on Microsoft SharePoint Server 2010 SP2
Word Automation Services on Microsoft SharePoint Server 2010 SP2
Microsoft Office Web Apps 2010 SP2

Overview

Multiple Vulnerabilities have been reported in various components of Microsoft Products.

Description

The vulnerability notes released by CERT-In with reference to Microsoft Security Bulletins are given below:

Microsoft Security Bulletin	Severity	CERT-In Vulnerability Notes
MS16-144:Cumulative Security Update for Internet Explorer	High	CIVN-2016-0310 Multiple Vulnerabilities in Microsoft Internet Explorer
MS16-145:Cumulative Security Update for Microsoft Edge	High	CIVN-2016-0311 Multiple Vulnerabilities in Microsoft Edge
MS16-146:Security Update for Microsoft Graphics Component	High	CIVN-2016-0312 Multiple Vulnerabilities in Microsoft Windows Graphics Component
MS-16-147:Security Update for Microsoft Uniscribe	High	CIVN-2016-0313 Remote Code Execution vulnerability in Microsoft Windows Uniscribe
MS16-148:Security Update for Microsoft Office	High	CIVN-2016-0314 Multiple Vulnerabilities in Microsoft Office
MS16-149:Security Update for Microsoft Windows	Medium	CIVN-2016-0315 Multiple Vulnerabilities in Microsoft Windows
MS16-150:Security Update for Secure Kernel Mode	High	CIVN-2016-0316 Microsoft Windows Secure Kernel Mode Privilege Escalation Vulnerability
MS16-151:Security Update for Windows Kernel-Mode Drivers	Medium	CIVN-2016-0317 Multiple Elevation of Privilege Vulnerabilities in Microsoft Windows Kernel Mode Drivers
MS16-152:Security Update for Windows Kernel	Medium	CIVN-2016-0318 Windows Kernel Memory Information Disclosure Vulnerability
MS16-153:Security Update for Common Log File System Driver	High	CIVN-2016-0319 Microsoft Windows Common Log File System Driver Information Disclosure Vulnerability
MS16-154:Security Update for Adobe Flash Player	High	CIVN-2016-0320 Microsoft Update for Vulnerabilities in Adobe Flash Player
MS16-155:Security Update for .NET Framework	High	CIVN-2016-0321 Multiple Vulnerabilities in Microsoft .NET Framework

Solution

Apply appropriate patches as mentioned in Microsoft Security Bulletin December 2016
https://technet.microsoft.com/en-us/library/security/ms16-dec.aspx

Vendor Information

Microsoft Corporation
https://technet.microsoft.com/en-us/library/security/ms16-dec.aspx

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India