See full blog post here: http://blog.shavlik.com/may-patch-tuesday-2016/ May’s Patch Tuesday has a few juicy surprises for us. On the Microsoft side, there is one vulnerability being exploited in the wild that affects both Internet Explorer (MS16-051) and Windows (MS16-053). Additionally, two public disclosures will raise concerns with Internet Explorer (MS16-051) and .Net Framework (MS16-065). We also have a Zero Day in Flash Player from Adobe that has caused some confusion considering Adobe just published an Advisory page (APSA16-02) stating the update resolves CVE-2016-4117, which was reported to Adobe by a researcher at FireEye, a security firm. We are also seeing Microsoft publish MS16-064, a bulletin to update Adobe Flash Player plug-in support for Windows and Internet Explorer; which has details of APSB16-15, including 24 CVEs that will be included in the update. So, the question is, why did Adobe not release the update? Will Microsoft end up pulling the bundled version in MS16-064 when the Adobe bulletin releases next week?

1. Patch Tuesday Webinar
Wednesday, May 11th, 2016
Chris Goettl
• Sr. Product Manager
Dial In: 1-855-749-4750 (US)
Attendees: 928 200 786

2. Agenda
May 2016 Patch Tuesday Overview
Known Issues
Bulletins
Q & A
1
2
3
4

3. Best Practices
Privilege Management
Mitigates Impact
High Threat Level vulnerabilities
warrant fast rollout. 2 weeks or
less is ideal to reduce exposure.
User Targeted – Whitelisting
and Containerization
mitigate

7. News –
Adobe Zero Day update releasing tomorrow (MOST LIKELY)
Expect a Chrome update
Expect another Microsoft Security Bulletin
FireFox will have a variation to be updated as well
QuickTime EOL for Windows
Apple says remove it!
Shavlik released QuickTime Removal Tool
Windows 10 Pro
GPO control of App Store not supported
AppSense Application Manager can still support this!

8. CSWU-024: Cumulative update for Windows 10: May 10, 2016
 Maximum Severity: Critical
 Affected Products: Windows 10, Edge, Internet Explorer, .Net Framework
 Description: This update for Windows 10 includes functionality improvements and resolves the vulnerabilities in Windows that are
described in the following Microsoft security bulletins and advisory: MS16-051, MS16-052, MS16-055, MS16-056, MS16-057, MS16-060,
MS16-061, MS16-062, MS16-064, MS16-065, MS16-066
 Impact: Remote Code Execution, Elevation of Privilege, Security Feature Bypass
 Fixes 25 vulnerabilities:
 CVE-2016-0149, CVE-2016-0168, CVE-2016-0169, CVE-2016-0170, CVE-2016-0171, CVE-2016-0173, CVE-2016-0174, CVE-2016-
0175, CVE-2016-0176, CVE-2016-0178, CVE-2016-0179, CVE-2016-0180, CVE-2016-0181, CVE-2016-0182, CVE-2016-0184,
CVE-2016-0186, CVE-2016-0187, CVE-2016-0188, CVE-2016-0189 (Exploited), CVE-2016-0191, CVE-2016-0192, CVE-2016-
0193, CVE-2016-0194, CVE-2016-0195, CVE-2016-0196, CVE-2016-0197
 Restart Required: Requires Restart

9. MS16-051: Cumulative Security Update for Internet Explorer (3155533)
 Maximum Severity: Critical
 Affected Products: Internet Explorer
 Description: This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow
remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the
vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker
could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with
full user rights.
 Impact: Remote Code Execution
 Fixes 5 vulnerabilities:
 CVE-2016-0187, CVE-2016-0188 (Publicly Disclosed), CVE-2016-0189 (Exploited), CVE-2016-0192, CVE-2016-0194
 Restart Required: Requires Restart

10. MS16-052: Cumulative Security Update for Microsoft Edge (3155538)
 Maximum Severity: Critical
 Affected Products: Edge
 Description: This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote
code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities
could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system
could be less impacted than users with administrative user rights.
 Impact: Remote Code Execution
 Fixes 4 vulnerabilities:
 CVE-2016-0186, CVE-2016-0191, CVE-2016-0192, CVE-2016-0193
 Restart Required: Requires Restart

11. MS16-053: Cumulative Security Update for JScript and VBScript (3156764)
 Maximum Severity: Critical
 Affected Products: Windows
 Description: This security update resolves vulnerabilities in the JScript and VBScript scripting engines in Microsoft Windows. The
vulnerabilities could allow remote code execution if a user visits a specially crafted website. An attacker who successfully exploited these
vulnerabilities could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker
who successfully exploited these vulnerabilities could take control of an affected system. An attacker could then install programs; view,
change, or delete data; or create new accounts with full user rights.
 Impact: Remote Code Execution
 Fixes 2 vulnerabilities:
 CVE-2016-0187, CVE-2016-0189 (Exploited)
 Restart Required: May Require Restart

12. MS16-054: Security Update for Microsoft Office (3155544)
 Maximum Severity: Critical
 Affected Products: Office, SharePoint
 Description: This security update resolves vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if
a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the
context of the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than
those who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 4 vulnerabilities:
 CVE-2016-0126, CVE-2016-0140, CVE-2016-0183, CVE-2016-0198
 Restart Required: May Require Restart

13. MS16-055: Security Update for Microsoft Graphics Component (3156754)
 Maximum Severity: Critical
 Affected Products: Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The most severe of the vulnerabilities could allow
remote code execution if a user opens a specially crafted document or visits a specially crafted website. Users whose accounts are
configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 5 vulnerabilities:
 CVE-2016-0168, CVE-2016-0169, CVE-2016-0170, CVE-2016-0184, CVE-2016-0195
 Restart Required: Requires Restart

14. MS16-056: Security Update for Windows Journal (3156761)
 Maximum Severity: Critical
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution
if a user opens a specially crafted Journal file. Users whose accounts are configured to have fewer user rights on the system could be less
impacted than users who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities:
 CVE-2016-0182
 Restart Required: May Require Restart

15. MS16-057: Security Update for Windows Shell (3156987)
 Maximum Severity: Critical
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution
if an attacker successfully convinces a user to browse to a specially crafted website that accepts user-provided online content, or convinces
a user to open specially crafted content. An attacker who successfully exploited this vulnerability could gain the same user rights as the
current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate
with administrative user rights.
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities:
 CVE-2016-0179
 Restart Required: Requires Restart

16. MS16-064: Security Update for Adobe Flash Player (3157993)
 Maximum Severity: Critical
 Affected Products: Adobe Flash Player, Windows
 Description: This security update resolves vulnerabilities in Adobe Flash Player when installed on all supported editions of Windows
8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT 8.1, and Windows 10.
 Impact: Remote Code Execution
 Fixes 24 vulnerabilities:
 CVE-2016-1096, CVE-2016-1097 CVE-2016-1098 CVE-2016-1099 CVE-2016-1100 CVE-2016-1101 CVE-2016-1102 CVE-2016-
1103 CVE-2016-1104 CVE-2016-1105 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-
2016-4108 CVE-2016-4109 CVE-2016-4110 CVE-2016-4111 CVE-2016-4112 CVE-2016-4113 CVE-2016-4114 CVE-2016-4115,
CVE-2016-4116
 Restart Required: Requires Restart

17. MS16-065: Security Update for .NET Framework (3156757)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft .NET Framework. The vulnerability could cause information
disclosure if an attacker injects unencrypted data into the target secure channel and then performs a man-in-the-middle (MiTM) attack
between the targeted client and a legitimate server.
 Impact: Information Disclosure
 Fixes 1 vulnerabilities:
 CVE-2016-0149 (Publicly Disclosed)
 Restart Required: May Require Restart

18. APSA16-02 + APSB16-015: Security Advisory for Adobe Flash Player
 Maximum Severity: Critical
 Affected Products: Adobe Flash Player
 Description: Adobe has released security updates for Adobe Flash Player for Windows, Macintosh, Linux and ChromeOS. These
updates address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.
• Adobe is aware of reports that CVE-2016-1019 is being actively exploited on systems running Windows 10 and earlier with Flash Player
version 20.0.0.306 and earlier. Please refer to APSA16-01 for details
 .
 Impact: Remote Code Execution
 Fixes 25 vulnerabilities:
 CVE-2016-1096, CVE-2016-1097 CVE-2016-1098 CVE-2016-1099 CVE-2016-1100 CVE-2016-1101 CVE-2016-1102 CVE-2016-
1103 CVE-2016-1104 CVE-2016-1105 CVE-2016-1106 CVE-2016-1107 CVE-2016-1108 CVE-2016-1109 CVE-2016-1110 CVE-
2016-4108 CVE-2016-4109 CVE-2016-4110 CVE-2016-4111 CVE-2016-4112 CVE-2016-4113 CVE-2016-4114 CVE-2016-4115,
CVE-2016-4116, CVE-2016-4117 (Exploited)
 Restart Required: Requires Restart

19. APSB16-14: Security Updates Available for Adobe Acrobat and Reader
 Maximum Severity: Important
 Affected Products: Adobe Acrobat and Reader
 Description: Adobe has released security updates for Adobe Acrobat and Reader for Windows and Macintosh. These updates
address critical vulnerabilities that could potentially allow an attacker to take control of the affected system.
 Impact: Remote Code Execution
 Fixes 82 vulnerabilities:
 CVE-2016-1037, CVE-2016-1038, CVE-2016-1039, CVE-2016-1040, CVE-2016-1041, CVE-2016-1042, CVE-2016-1043, CVE-2016-
1044, CVE-2016-1045, CVE-2016-1046, CVE-2016-1047, CVE-2016-1048, CVE-2016-1049, CVE-2016-1050, CVE-2016-1051,
CVE-2016-1052, CVE-2016-1053, CVE-2016-1054, CVE-2016-1055, CVE-2016-1056, CVE-2016-1057, CVE-2016-1058, CVE-2016-
1059, CVE-2016-1060, CVE-2016-1061, CVE-2016-1062, CVE-2016-1063, CVE-2016-1064, CVE-2016-1065, CVE-2016-1066,
CVE-2016-1067, CVE-2016-1068, CVE-2016-1069, CVE-2016-1070, CVE-2016-1071, CVE-2016-1072, CVE-2016-1073, CVE-2016-
1074, CVE-2016-1075, CVE-2016-1076, CVE-2016-1077, CVE-2016-1078, CVE-2016-1079, CVE-2016-1080, CVE-2016-1081,
CVE-2016-1082, CVE-2016-1083, CVE-2016-1084, CVE-2016-1085, CVE-2016-1086, CVE-2016-1087, CVE-2016-1088, CVE-2016-
1090, CVE-2016-1092, CVE-2016-1093, CVE-2016-1094, CVE-2016-1095, CVE-2016-1112, CVE-2016-1116, CVE-2016-1117,
CVE-2016-1118, CVE-2016-1119, CVE-2016-1120, CVE-2016-1121, CVE-2016-1122, CVE-2016-1123, CVE-2016-1124, CVE-2016-
1125, CVE-2016-1126, CVE-2016-1127, CVE-2016-1128, CVE-2016-1129, CVE-2016-1130, CVE-2016-4088, CVE-2016-4089,
CVE-2016-4090, CVE-2016-4091, CVE-2016-4092, CVE-2016-4093, CVE-2016-4094, CVE-2016-4096, CVE-2016-4097, CVE-2016-
4098, CVE-2016-4099, CVE-2016-4100, CVE-2016-4101, CVE-2016-4102, CVE-2016-4103, CVE-2016-4104, CVE-2016-4105,
CVE-2016-4106, CVE-2016-4107
 Restart Required:

20. MS16-058: Security Update for Windows IIS (3141083)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution
if an attacker with access to the local system executes a malicious application. An attacker who successfully exploited this vulnerability could
gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less
impacted than those who operate with administrative user rights..
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities:
 CVE-2016-0152
 Restart Required: Requires Restart

21. MS16-059: Security Update for Windows Media Center (3150220)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution
if Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code. An attacker who successfully
exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user
rights on the system could be less impacted than those who operate with administrative user rights.
 Impact: Remote Code Execution
 Fixes 1 vulnerabilities:
 CVE-2016-0185
 Restart Required: May Require Restart

22. MS16-060: Security Update for Windows Kernel (3154846)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if
an attacker logs on to an affected system and runs a specially crafted application.
 Impact: Elevation of Privilege
 Fixes 1 vulnerabilities:
 CVE-2016-0180
 Restart Required: Requires Restart

23. MS16-061: Security Update for Microsoft RPC (3155520)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if
an unauthenticated attacker makes malformed Remote Procedure Call (RPC) requests to an affected host.
 Impact: Elevation of Privilege
 Fixes 1 vulnerabilities:
 CVE-2016-0178
 Restart Required: Requires Restart

24. MS16-062: Security Update for Windows Kernel-Mode Drivers (3158222)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow
elevation of privilege if an attacker logs on to an affected system and runs a specially crafted application.
 Impact: Elevation of Privilege
 Fixes 7 vulnerabilities:
 CVE-2016-0171, CVE-2016-0173, CVE-2016-0174, CVE-2016-0175, CVE-2016-0176, CVE-2016-0196, CVE-2016-0197
 Restart Required: Requires Restart

25. MS16-066: Security Update for Virtual Secure Mode (3155451)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass
if an attacker runs a specially crafted application to bypass code integrity protections in Windows.
 Impact: Security Feature Bypass
 Fixes 1 vulnerabilities:
 CVE-2016-0181
 Restart Required: Requires Restart

26. MS16-067: Security Update for Volume Manager Driver (3155784)
 Maximum Severity: Important
 Affected Products: Windows
 Description: This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow information disclosure if
a USB disk mounted over Remote Desktop Protocol (RDP) via Microsoft RemoteFX is not correctly tied to the session of the mounting user.
 Impact: Information Disclosure
 Fixes 1 vulnerabilities:
 CVE-2016-0190
 Restart Required: May Require Restart

27. Between Patch Tuesdays
New Product Support: Adobe Flash Pepper Plugin and Debugger, CoreFTP 2
x64, Foxit PhantomPDF 7, AutoCAD 2016 and 2017, Nitro Pro 10
Security Updates: Chrome (2), FireFox (3), Thunderbird, Flash Pepper Plugin,
Skype (2), Apache Tomcat, Flash Player (2), Java, WireShark, FileZilla (2),
TortoiseSVN
Non-Security Updates: Microsoft (70+), Dropbox, GoToMeeting, CoreFTP,
BoxSync, LibreOffice, Google Drive, GoodSync (2), CCleaner, HipChat,
PDFXchange, TeamViewer, Citrix XenApp, KeePass, AutoCAD, Citrix Receiver,
Nitro Pro
Security Tools: QuickTime removal tool

29. • Why should you attend?
• Great Value:
• Two days of hands on and deep dive
product sessions for less than one day of
consulting services
• Interaction with Shavlik Product
Managers and Systems Engineers
• Tech-Summit Pass $995
• And, of course, because its Vegas baby!
• For details see:
• http://www.shavlik.com/tech-summit/

30. Resources and Webinars
Get Shavlik Content Updates
Get Social with Shavlik
Sign up for next months
Patch Tuesday Webinar
Watch previous webinars
and download presentation.

31. Thank you