Microsoft · Security update · April 12, 2016

KB3147461: April 2016 cumulative update for Windows 10 1507

KB3147461, released April 12, 2016, fixes 18 CVEs across 8 products. 3 of them are being exploited (CVE-2016-0151); 3 on CISA KEV. Patch Radar priority: Patch now. The product is no longer supported.

Patch now3 on CISA KEVKnown ransomware use3 publicly disclosedUnsupported product
CVEs closed
18
5 rated Critical
Exploited
3
CVE-2016-0151
Exploitation more likely
6
Vendor assessment
Highest EPSS
0.6809
99th percentile

Priority of the 18 CVEs

Patch now 3 Urgent 7 High 7 Routine 1

Applies to

Product
Internet Explorer 11 on Windows 10 for 32-bit Systems
Internet Explorer 11 on Windows 10 for x64-based Systems
Microsoft .NET Framework 3.5 on Windows 10 for 32-bit Systems
Microsoft .NET Framework 3.5 on Windows 10 for x64-based Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 for 32-bit Systems
Microsoft Edge (EdgeHTML-based) on Windows 10 for x64-based Systems
Windows 10 for 32-bit Systems
Windows 10 for x64-based Systems

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Patch now CVE-2016-0151 CSRSS Security Feature Bypass n/a 0.6282 KEVRansomwareExploited
Patch now CVE-2016-0165 Microsoft Graphics Component Elevation of Privilege 7.8 0.1368 KEVExploited
Patch now CVE-2016-0167 Microsoft Graphics Component Elevation of Privilege n/a 0.0566 KEVRansomwareExploited
Urgent CVE-2016-0145 Microsoft Graphics Component Remote Code Execution n/a 0.4084 Exploitation Less Likely
Urgent CVE-2016-0156 Microsoft Edge Remote Code Execution n/a 0.1872 More likely
Urgent CVE-2016-0166 Internet Explorer Remote Code Execution n/a 0.1551 More likely
Urgent CVE-2016-0157 Microsoft Edge Remote Code Execution n/a 0.1539 More likely
Urgent CVE-2016-0158 Microsoft Edge Elevation of Privilege n/a 0.1472 More likely
Urgent CVE-2016-0154 Microsoft Browsers Remote Code Execution n/a 0.1388 More likely
Urgent CVE-2016-0143 Microsoft Graphics Component Elevation of Privilege n/a 0.0334 More likely
High CVE-2016-0150 HTTP.sys Denial of Service n/a 0.2801 Exploitation Unlikely
High CVE-2016-0128 SAM and LSAD Remote Protocols Elevation of Privilege n/a 0.2080 DisclosedExploitation Unlikely
High CVE-2016-0160 Internet Explorer Remote Code Execution n/a 0.1294 DisclosedExploitation Less Likely
High CVE-2016-0088 Windows Hyper-V Remote Code Execution n/a 0.0735 Exploitation Unlikely
High CVE-2016-0089 Windows Hyper-V Information Disclosure n/a 0.0333 Exploitation Unlikely
High CVE-2016-0090 Windows Hyper-V Information Disclosure n/a 0.0296 Exploitation Unlikely
High CVE-2016-0135 Secondary Logon Elevation of Privilege n/a 0.0154 DisclosedExploitation Less Likely
Routine CVE-2016-0161 Microsoft Edge Elevation of Privilege n/a 0.6809 Exploitation Unlikely
Showing 1 to 18 of 18 1