Microsoft Patch Tuesday - September 2016
Summary: Microsoft's September 2016 Patch Tuesday released fourteen bulletins covering fifty security vulnerabilities, seven of them rated Critical and affecting Internet Explorer, Microsoft Edge, Microsoft Graphics Component, Exchange Server, Office, OLE Automation for VBScript Scripting Engine, and Adobe Flash Player. The most severe issues include CVE-2016-3295, a memory corruption flaw in how IE and Edge handle objects in memory that allows remote code execution, and MS16-117, which fixes all twenty-nine Flash vulnerabilities in Adobe Security Bulletin APSB16-29.
Bottom line: Two of this month's fixes require pairing: Microsoft says protection from the MS16-116 VBScript flaw needs both that update and MS16-104 installed, so a partial patch leaves the remote code execution path open. MS16-112 also lets an attacker with physical access to a locked machine run code by connecting it to a malicious WiFi hotspot or inserting a mobile broadband adaptor.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2016-3295CVE-2016-3356CVE-2016-3357
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026