Patch Tuesday, May 2016

Microsoft's monthly security release, Tuesday, May 10, 2016. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

2 CVEs · 0 critical · 2 exploited · 2 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← April 2016 June 2016 →Open in the dashboard

Microsoft

2 CVEs · 0 critical · 2 exploited · 2 with public exploit code

7.8HighMay 11, 2016Microsoft Windows Code / command injectionCVE-2016-0185Microsoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.Exploited70% likelyExploit codeExploit-DB
7.5HighMay 11, 2016Microsoft Internet Explorer Memory corruptionCVE-2016-0189The Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.Exploited94% likelyExploit codeExploit-DB · MetasploitDetection

Adobe

1 CVE · 0 critical · 1 exploited · 1 with public exploit code

7.8HighMay 11, 2016Adobe Flash Player Code / command injectionCVE-2016-4117An access of resource using incompatible type vulnerability exists within Adobe Flash Player that allows an attacker to perform remote code execution.Exploited94% likelyExploit codeExploit-DB · Metasploit

SAP

No tracked SAP CVEs in this window.

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.