Patch Tuesday, June 2016

Microsoft's monthly security release, Tuesday, June 14, 2016. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

1 CVE · 0 critical · 1 exploited · 1 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← May 2016 July 2016 →Open in the dashboard

Microsoft

1 CVE · 0 critical · 1 exploited · 1 with public exploit code

7.8HighJun 16, 2016Microsoft Office Privilege escalationCVE-2016-3235Microsoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.Exploited43% likelyExploit codeExploit-DB · Metasploit

Adobe

1 CVE · 0 critical · 1 exploited · 0 with public exploit code

7.8HighJun 16, 2016Adobe Flash Player Code / command injectionCVE-2016-4171Unspecified vulnerability in Adobe Flash Player allows for remote code execution.Exploited20% likely

SAP

No tracked SAP CVEs in this window.

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.