Patch Tuesday, November 2016
Microsoft's monthly security release, Tuesday, November 8, 2016. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 3 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 3 with public exploit code
- 8.8HighNov 10, 2016Microsoft Edge Memory corruptionCVE-2016-7200The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.Exploited83% likelyExploit codeExploit-DBDetection
- 8.8HighNov 10, 2016Microsoft Edge Memory corruptionCVE-2016-7201The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.Exploited80% likelyExploit codeExploit-DB
- 7.8HighNov 10, 2016Microsoft Win32k Privilege escalationCVE-2016-7255Microsoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.Exploited81% likelyExploit codeExploit-DB
- 8.8HighNov 10, 2016Microsoft Windows Auth bypass / access controlCVE-2016-7256A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.Exploited65% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.