Microsoft · Security update · April 12, 2016

KB3147458: April 2016 cumulative update for Windows 10 1511

KB3147458, released April 12, 2016, fixes 16 CVEs across 8 products. 3 of them are being exploited (CVE-2016-0151); 3 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now3 on CISA KEVKnown ransomware use3 publicly disclosedUnsupported product
CVEs closed
16
6 rated Critical
Exploited
3
CVE-2016-0151
Exploitation more likely
7
Vendor assessment
Highest EPSS
0.6809
99th percentile

Priority of the 16 CVEs

Patch now 3 Urgent 8 High 4 Routine 1

Applies to

ProductBuild after install
Internet Explorer 11 on Windows 10 Version 1511 for 32-bit Systems10586.218
Internet Explorer 11 on Windows 10 Version 1511 for x64-based Systems10586.218
Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for 32-bit Systems10586.218
Microsoft .NET Framework 3.5 on Windows 10 Version 1511 for x64-based Systems10586.218
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for 32-bit Systems10586.218
Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1511 for x64-based Systems10586.218
Windows 10 Version 1511 for 32-bit Systems10586.218
Windows 10 Version 1511 for x64-based Systems10586.218

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2016-0151 CSRSS Security Feature Bypass n/a 0.6282 KEVRansomwareExploited
Patch now CVE-2016-0165 Microsoft Graphics Component Elevation of Privilege 7.8 0.1368 KEVExploited
Patch now CVE-2016-0167 Microsoft Graphics Component Elevation of Privilege n/a 0.0566 KEVRansomwareExploited
Urgent CVE-2016-0145 Microsoft Graphics Component Remote Code Execution n/a 0.4084 Exploitation Less Likely
Urgent CVE-2016-0156 Microsoft Edge Remote Code Execution n/a 0.1872 More likely
Urgent CVE-2016-0166 Internet Explorer Remote Code Execution n/a 0.1551 More likely
Urgent CVE-2016-0157 Microsoft Edge Remote Code Execution n/a 0.1539 More likely
Urgent CVE-2016-0158 Microsoft Edge Elevation of Privilege n/a 0.1472 More likely
Urgent CVE-2016-0154 Microsoft Browsers Remote Code Execution n/a 0.1388 More likely
Urgent CVE-2016-0155 Microsoft Edge Remote Code Execution n/a 0.1007 More likely
Urgent CVE-2016-0143 Microsoft Graphics Component Elevation of Privilege n/a 0.0334 More likely
High CVE-2016-0150 HTTP.sys Denial of Service n/a 0.2801 Exploitation Unlikely
High CVE-2016-0128 SAM and LSAD Remote Protocols Elevation of Privilege n/a 0.2080 DisclosedExploitation Unlikely
High CVE-2016-0160 Internet Explorer Remote Code Execution n/a 0.1294 DisclosedExploitation Less Likely
High CVE-2016-0135 Secondary Logon Elevation of Privilege n/a 0.0154 DisclosedExploitation Less Likely
Routine CVE-2016-0161 Microsoft Edge Elevation of Privilege n/a 0.6809 Exploitation Unlikely
Showing 1 to 16 of 16 1