Microsoft · Security update · December 13, 2016

KB3205409: December 2016 security update

KB3205409, released December 13, 2016, fixes 14 CVEs across 3 products. None of them is reported as exploited. Patch Radar priority: Urgent.

Urgent2 publicly disclosed
CVEs closed
14
2 rated Critical
Exploited
0
None reported
Exploitation more likely
6
Vendor assessment
Highest EPSS
0.7394
99th percentile

Priority of the 14 CVEs

Patch now 0 Urgent 6 High 2 Routine 6

Applies to

Product
Internet Explorer 10 on Windows Server 2012
Windows Server 2012
Windows Server 2012 (Server Core installation)

CVEs this fix closes

PriorityCVEComponentImpactCVSSEPSSExploitation
Urgent CVE-2016-7202 Microsoft Browsers Remote Code Execution 4.2 0.7394 More likely
Urgent CVE-2016-7274 Microsoft Office Remote Code Execution 6.4 0.4049 More likely
Urgent CVE-2016-7272 Microsoft Graphics Component Remote Code Execution 6.4 0.3926 More likely
Urgent CVE-2016-7283 Internet Explorer Remote Code Execution 6.4 0.1794 More likely
Urgent CVE-2016-7279 Microsoft Browsers Remote Code Execution 6.4 0.1511 More likely
Urgent CVE-2016-7292 Microsoft Windows Elevation of Privilege 7.3 0.0147 More likely
High CVE-2016-7259 Windows Kernel-Mode Drivers Elevation of Privilege 7.0 0.0214 Exploitation Unlikely
High CVE-2016-7260 Windows Kernel-Mode Drivers Elevation of Privilege 7.0 0.0156 Exploitation Less Likely
Routine CVE-2016-7284 Internet Explorer Information Disclosure 4.3 0.1510 Exploitation Less Likely
Routine CVE-2016-7278 Internet Explorer Information Disclosure 2.4 0.1479 Exploitation Less Likely
Routine CVE-2016-7281 Microsoft Browsers Information Disclosure 4.3 0.1331 DisclosedExploitation Unlikely
Routine CVE-2016-7282 Microsoft Browsers Information Disclosure 4.3 0.1006 DisclosedExploitation Unlikely
Routine CVE-2016-7219 Microsoft Windows Information Disclosure 6.7 0.0343 Exploitation Unlikely
Routine CVE-2016-7295 Common Log File System Driver Information Disclosure 6.0 0.0329 Exploitation Less Likely
Showing 1 to 14 of 14 1