Privilege escalation

The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."...

Memory corruption

The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016;...

Denial of service

HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service system hang via crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability."...

Design/Logic Flaw

The SAM and LSAD protocol implementations in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 do not properly establish an RPC channel, which allows man-in-the-middle attacker...

Privilege escalation

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege...

Privilege escalation

The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege...

CVE-2016-0151

The Client-Server Run-time Subsystem CSRSS in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mismanages process tokens, which allows local users to gain privileges via a crafted application, aka "Windows CSRSS Security Feature Bypass...

CVE-2016-0151

CVE-2016-0151 affects the Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 (Gold/R2), Windows RT 8.1, and Windows 10 (Gold/1511). The root cause is mismanagement of process tokens in CSRSS/in memory, enabling local privilege escalation via a crafted applicati...

CVE-2016-0150

HTTP.sys in Microsoft Windows 10 Gold and 1511 allows remote attackers to cause a denial of service system hang via crafted HTTP 2.0 requests, aka "HTTP.sys Denial of Service Vulnerability."...

CVE-2016-0145

The font library in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold and 1511; Office 2007 SP3 and 2010 SP2; Word Viewer; .NET Framework 3.0 SP2, 3.5, and 3.5.1; Skype for Business 2016;...

CVE-2016-0090

Summary: CVE-2016-0090 is a Windows Hyper-V Information Disclosure vulnerability. It affects Hyper-V on Windows 8.1, Windows Server 2012 R2, and Windows 10 where a guest OS user can cause the Hyper-V host to disclose memory contents via a crafted application. Root cause: inadequate validation of ...

CVE-2016-0150

CVE-2016-0150 describes a Denial of Service in Microsoft Windows HTTP.sys (HTTP 2.0 stack). A remote, unauthenticated attacker can send specially crafted HTTP/2 requests to Windows 10 Gold and 1511 to cause the system to become unresponsive. Connected advisories (MS16-049) document the fix as a s...

CVE-2016-0088

Hyper-V in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, and Windows 10 allows guest OS users to execute arbitrary code on the host OS via a crafted application, aka "Hyper-V Remote Code Execution Vulnerability."...

CVE-2016-0167

CVE-2016-0167 is a Windows kernel-mode Win32k Privilege Escalation vulnerability affecting multiple OS versions (e.g., Vista SP2, Windows 7 SP1, Windows 8.1, Windows Server 2008/R2, Windows 10). The issue arises in the kernel-mode driver Win32k where a crafted application can escalate privileges ...

CVE-2016-0145

CVE-2016-0145 is a Graphics Memory Corruption vulnerability in the Windows font library. A remote attacker can execute arbitrary code by delivering a crafted embedded font, affecting Windows flavors listed in the vulnerability entry (e.g., Windows Vista through Windows 10 versions, Windows Server...

CVE-2016-0088

CVE-2016-0088 corresponds to a Hyper-V remote code execution vulnerability in Microsoft Windows Hyper-V affecting Windows 8.1, Windows Server 2012 (Gold/R2), and Windows 10. The root cause is that Hyper-V fails to properly validate guest OS input from an authenticated user, enabling a crafted app...

CVE-2016-0135

CVE-2016-0135 is a local elevation-of-privilege vulnerability in the Windows Secondary Logon Service, affecting Windows 10 Gold and 1511. The issue stems from the service failing to properly manage in-memory requests, enabling a crafted local attacker to gain administrator-level privileges. Micro...

MS16-048: Description of the security update for CSRSS: April 12, 2016

None None...

CVE-2016-0135: Improper Restriction of Operations within the Bounds of a Memory Buffer

The Secondary Logon Service in Microsoft Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "Secondary Logon Elevation of Privilege Vulnerability."...

Microsoft Windows Hyper-V CVE-2016-0089 Information Disclosure Vulnerability

Description Microsoft Windows is prone to an information-disclosure vulnerability. Attackers can exploit this issue to obtain sensitive information that may aid in launching further attacks. Technologies Affected Microsoft Windows 10 for x64-based Systems Microsoft Windows 8.1 for x64-based Syste...