Patch Tuesday, April 2016
Microsoft's monthly security release, Tuesday, April 12, 2016. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
- 7.8HighApr 12, 2016Microsoft Client-Server Run-time Subsystem (CSRSS) Privilege escalationCVE-2016-0151The Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.Exploited63% likelyExploit codeExploit-DB
- 7.8HighApr 12, 2016Microsoft Win32k Privilege escalationCVE-2016-0165Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.Exploited14% likelyExploit codeExploit-DB
- 7.8HighApr 12, 2016Microsoft Win32k Privilege escalationCVE-2016-0167Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted applicationExploited5.7% likely
- 4.3MediumApr 12, 2016Microsoft Internet Explorer Information disclosureCVE-2016-0162An information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.Exploited22% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.