Microsoft Patchday: Updates July 2016

Microsoft has released several critical and non-critical updates for Windows, Flash, Browser, Office an Net at patch day (July 12, 2016).

A list of all July 2016 updates may be found here at this Microsoft site. Below is a compilation together with affected software.

Critical system updates

MS16-084: Cumulative Security Update for Internet Explorer (3169991)
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Status: Critical, Remote Code Execution

Affected software:
   – Windows Vista Service Pack 2:
     – Internet Explorer 9
   – Windows Vista x64 Edition Service Pack 2:
     – Internet Explorer 9
   – Windows Server 2008 for 32-bit Systems Service Pack 2:
     – Internet Explorer 9
     (Windows Server 2008 Server Core installation not affected)
   – Windows Server 2008 for x64-based Systems Service Pack 2:
     – Internet Explorer 9
     (Windows Server 2008 Server Core installation not affected)
   – Windows 7 for 32-bit Systems Service Pack 1:
     – Internet Explorer 11
   – Windows 7 for x64-based Systems Service Pack 1:
     – Internet Explorer 11
   – Windows Server 2008 R2 for x64-based Systems
     Service Pack 1:
     – Internet Explorer 11
     (Windows Server 2008 R2 Server Core installation
     not affected)
   – Windows 8.1 for 32-bit Systems:
     – Internet Explorer 11
   – Windows 8.1 for x64-based Systems:
     – Internet Explorer 11
   – Windows Server 2012:
     – Internet Explorer 10
     (Windows Server 2012 Server Core installation not affected)
   – Windows Server 2012 R2:
     – Internet Explorer 11
     (Windows Server 2012 R2 Server Core installation not affected)
   – Windows RT 8.1:
     – Internet Explorer 11
   – Windows 10 for 32-bit Systems:
     – Internet Explorer 11
   – Windows 10 for x64-based Systems:
     – Internet Explorer 11
   – Windows 10 Version 1511 for 32-bit Systems:
     – Internet Explorer 11
   – Windows 10 Version 1511 for x64-based Systems:
     – Internet Explorer 11

MS16-085: Cumulative Security Update for Microsoft Edge (3169999)
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.

Status: Critical, Remote Code Execution

Affected software:

– Windows 10 for 32-bit Systems
  – Microsoft Edge
– Windows 10 for x64-based Systems
  – Microsoft Edge
– Windows 10 Version 1511 for 32-bit Systems
  – Microsoft Edge
– Windows 10 Version 1511 for x64-based Systems
  – Microsoft Edge

MS16-086: Cumulative Security Update for JScript and VBScript (3169996)
This security update resolves a vulnerability in the JScript and VBScript scripting engines in Microsoft Windows. The vulnerability could allow remote code execution if a user visits a specially crafted website. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerabilities could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Status: Critical, Remote Code Execution

Affected software:

– Windows Vista Service Pack 2
  – VBScript 5.7
– Windows Vista x64 Edition Service Pack 2
  – VBScript 5.7
– Windows Server 2008 for 32-bit Systems Service Pack 2
  – VBScript 5.7
   (Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems Service Pack 2
  – VBScript 5.7
   (Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems Service Pack 2
  – VBScript 5.7
– Windows Server 2008 R2 for x64-based Systems Service Pack 1
   (Server Core installation only)
  – JScript 5.8 and VBScript 5.8

MS16-087: Security Update for Windows Print Spooler Components (3170005)
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker is able to execute a man-in-the-middle (MiTM) attack on a workstation or print server, or set up a rogue print server on a target network.

Status: Critical, Remote Code Execution

Affected software:
– Windows Vista Service Pack 2
– Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems Service Pack 2
  (Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems Service Pack 2
  (Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems Service Pack 2
– Windows 7 for 32-bit Systems Service Pack 1
– Windows 7 for x64-based Systems Service Pack 1
– Windows Server 2008 R2 for x64-based Systems Service Pack 1
  (Windows Server 2008 R2 Server Core installation affected)
– Windows Server 2008 R2 for Itanium-based Systems Service
  Pack 1
– Windows 8.1 for 32-bit Systems
– Windows 8.1 for x64-based Systems
– Windows Server 2012
  (Windows Server 2012 Server Core installation affected)
– Windows Server 2012 R2
  (Windows Server 2012 R2 Server Core installation affected)
– Windows RT 8.1
– Windows 10 for 32-bit Systems
– Windows 10 for x64-based Systems
– Windows 10 Version 1511 for 32-bit Systems
– Windows 10 Version 1511 for x64-based Systems

MS16-088: Security Update for Microsoft Office (3170008)
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Status: Critical, Remote Code Execution

Affected software:

– Microsoft Excel 2007 Service Pack 3
– Microsoft Word 2007 Service Pack 3
– Microsoft Office 2010 Service Pack 2 (32-bit editions)
– Microsoft Office 2010 Service Pack 2 (64-bit editions)
– Microsoft Excel 2010 Service Pack 2 (32-bit editions)
– Microsoft Excel 2010 Service Pack 2 (64-bit editions)
– Microsoft Outlook 2010 Service Pack 2 (32-bit editions)
– Microsoft Outlook 2010 Service Pack 2 (64-bit editions)
– Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)
– Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)
– Microsoft Word 2010 Service Pack 2 (32-bit editions)
– Microsoft Word 2010 Service Pack 2 (64-bit editions)
– Microsoft Excel 2013 Service Pack 1 (32-bit editions)
– Microsoft Excel 2013 Service Pack 1 (64-bit editions)
– Microsoft Outlook 2013 Service Pack 1 (32-bit editions)
– Microsoft Outlook 2013 Service Pack 1 (64-bit editions)
– Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions)
– Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions)
– Microsoft Word 2013 Service Pack 1 (32-bit editions)
– Microsoft Word 2013 Service Pack 1 (64-bit editions)
– Microsoft Excel 2013 RT Service Pack 1
– Microsoft Outlook 2013 RT Service Pack 1
– Microsoft PowerPoint 2013 RT Service Pack 1
– Microsoft Word 2013 RT Service Pack 1
– Microsoft Excel 2016 (32-bit edition)
– Microsoft Excel 2016 (64-bit edition)
– Microsoft Outlook 2016 (32-bit edition)
– Microsoft Outlook 2016 (64-bit edition)
– Microsoft Word 2016 (32-bit edition)
– Microsoft Word 2016 (64-bit edition)
– Microsoft Excel for Mac 2011
– Microsoft Word for Mac 2011
– Microsoft Excel 2016 for Mac
– Microsoft Word 2016 for Mac
– Microsoft Office Compatibility Pack Service Pack 3
– Microsoft Excel Viewer
– Microsoft Word Viewer
– Word Automation Services on Microsoft SharePoint Server 2010
  Service Pack 2
– Word Automation Services on Microsoft SharePoint Server 2013
  Service Pack 1
– Microsoft SharePoint Server 2016
– Microsoft Office Web Apps 2010 Service Pack 2
– Microsoft Office Web Apps Server 2013 Service Pack 1
– Office Online Server

MS16-093: Security Update for Adobe Flash Player (3174060)
This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows 8.1, Windows Server 2012, Windows RT 8.1, Windows Server 2012 R2, and Windows 10..

Status: Critical, Remote Code Execution

Affected software:
– Windows 8.1 for 32-bit Systems
– Windows 8.1 for x64-based Systems
– Windows Server 2012
  (Windows Server 2012 Server Core installation not affected)
– Windows Server 2012 R2
  (Windows Server 2012 R2 Server Core installation not affected)
– Windows RT 8.1
– Windows 10 for 32-bit Systems
– Windows 10 for x64-based Systems
– Windows 10 Version 1511 for 32-bit Systems
– Windows 10 Version 1511 for x64-based Systems

Important system updates

MS16-089:

Security Update for Windows Secure Kernel Mode (3170050)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure when Windows Secure Kernel Mode improperly handles objects in memory.

Status: Important, Information Disclosure

Affected software:
– Windows 10 for 32-bit Systems
– Windows 10 for x64-based Systems
– Windows 10 Version 1511 for 32-bit Systems
– Windows 10 Version 1511 for x64-based Systems

MS16-090: Security Update for Windows Kernel-Mode Drivers (3171481)
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application that could exploit the vulnerabilities and take control of an affected system.

Status: Important, Elevation of Privilege

Affected software:
– Windows Vista Service Pack 2
– Windows Vista x64 Edition Service Pack 2
– Windows Server 2008 for 32-bit Systems Service Pack 2
  (Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for x64-based Systems Service Pack 2
  (Windows Server 2008 Server Core installation affected)
– Windows Server 2008 for Itanium-based Systems Service Pack 2
– Windows 7 for 32-bit Systems Service Pack 1
– Windows 7 for x64-based Systems Service Pack 1
– Windows Server 2008 R2 for x64-based Systems Service Pack 1
  (Windows Server 2008 R2 Server Core installation affected)
– Windows Server 2008 R2 for Itanium-based Systems Service
  Pack 1
– Windows 8.1 for 32-bit Systems
– Windows 8.1 for x64-based Systems
– Windows Server 2012
  (Windows Server 2012 Server Core installation affected)
– Windows Server 2012 R2
  (Windows Server 2012 R2 Server Core installation affected)
– Windows RT 8.1
– Windows 10 for 32-bit Systems
– Windows 10 for x64-based Systems
– Windows 10 Version 1511 for 32-bit Systems
– Windows 10 Version 1511 for x64-based Systems

MS16-091: Security Update for .NET Framework (3170048)
This security update resolves a vulnerability in Microsoft .NET Framework. The vulnerability could cause information disclosure if an attacker uploads a specially crafted XML file to a web-based application.

Status: Important, Information Disclosure

Affected software:

– Windows Vista Service Pack 2:
  – Microsoft .NET Framework 2.0 Service Pack 2
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6
– Windows Vista x64 Edition Service Pack 2:
  – Microsoft .NET Framework 2.0 Service Pack 2
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6
– Windows Server 2008 for 32-bit Systems Service Pack 2:
  – Microsoft .NET Framework 2.0 Service Pack 2
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6
  (Windows Server 2008 Server Core installation not affected)
– Windows Server 2008 for x64-based Systems Service Pack 2:
  – Microsoft .NET Framework 2.0 Service Pack 2
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6
  (Windows Server 2008 Server Core installation not affected)
– Windows Server 2008 for Itanium-based Systems Service Pack 2:
  – Microsoft .NET Framework 2.0 Service Pack 2
– Windows 7 for 32-bit Systems Service Pack 1:
  – Microsoft .NET Framework 3.5.1
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
– Windows 7 for x64-based Systems Service Pack 1:
  – Microsoft .NET Framework 3.5.1
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
– Windows Server 2008 R2 for x64-based Systems Service Pack 1:
  – Microsoft .NET Framework 3.5.1
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
  (Windows Server 2008 R2 Server Core installation affected)
– Windows Server 2008 R2 for Itanium-based Systems Service
  Pack 1:
  – Microsoft .NET Framework 3.5.1
– Windows 8.1 for 32-bit Systems:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
– Windows 8.1 for x64-based Systems:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
– Windows Server 2012:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
  (Windows Server 2012 Server Core installation affected)
– Windows Server 2012 R2:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
  (Windows Server 2012 R2 Server Core installation affected)
– Windows RT 8.1:
  – Microsoft .NET Framework 4.5.2
  – Microsoft .NET Framework 4.6/4.6.1
– Windows 10 for 32-bit Systems:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.6
– Windows 10 for x64-based Systems:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.6
– Windows 10 Version 1511 for 32-bit Systems:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.6.1
– Windows 10 Version 1511 for x64-based Systems:
  – Microsoft .NET Framework 3.5
  – Microsoft .NET Framework 4.6.1

MS16-092: Security Update for Windows Kernel (3171910)
This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow security feature bypass if the Windows kernel fails to determine how a low integrity application can use certain object manager features.

Status: Important, Security Feature Bypass

Affected software:
– Windows 8.1 for 32-bit Systems
– Windows 8.1 for x64-based Systems
– Windows Server 2012
  (Windows Server 2012 Server Core installation affected)
– Windows Server 2012 R2
  (Windows Server 2012 R2 Server Core installation affected)
– Windows RT 8.1
– Windows 10 for 32-bit Systems
– Windows 10 for x64-based Systems
– Windows 10 Version 1511 for 32-bit Systems

MS16-094: Security Update for Secure Boot (3177404)
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow Secure Boot security features to be bypassed if an attacker installs an affected policy on a target device. An attacker must have either administrative privileges or physical access to install a policy and bypass Secure Boot.

Status: Important, Security Feature Bypass

Affected software:

– Windows 8.1 for 32-bit Systems
– Windows 8.1 for x64-based Systems
– Windows Server 2012
  (Windows Server 2012 Server Core installation affected)
– Windows Server 2012 R2
  (Windows Server 2012 R2 Server Core installation affected)
– Windows RT 8.1
– Windows 10 for 32-bit Systems
– Windows 10 for x64-based Systems
– Windows 10 Version 1511 for 32-bit Systems
– Windows 10 Version 1511 for x64-based Systems