Microsoft Security Bulletin MS16-012 - Critical
Security Update for Microsoft Windows PDF Library to Address Remote Code Execution (3138938)
Published: February 9, 2016
Version: 1.0
Executive Summary
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if Microsoft Windows PDF Library improperly handles application programming interface (API) calls, which could allow an attacker to run arbitrary code on the user’s system. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights. However, an attacker would have no way to force users to download or open a malicious PDF document.
This security update is rated Critical for all supported editions of Windows 8.1, Windows Server 2012, Windows Server 2012 R2, and Windows 10. For more information, see the Affected Software section.
The update addresses the vulnerabilities by changing how memory is handled when API calls are made to the PDF Library, and by modifying how Windows Reader parses files. For more information about the vulnerabilities, see the Vulnerability Information section.
For more information about this update, see Microsoft Knowledge Base Article 3138938.
Affected Software and Vulnerability Severity Ratings
The following software versions or editions are affected. Versions or editions that are not listed are either past their support life cycle or are not affected. To determine the support life cycle for your software version or edition, see Microsoft Support Lifecycle.
The following severity ratings assume the potential maximum impact of the vulnerability. For information regarding the likelihood, within 30 days of this security bulletin's release, of the exploitability of the vulnerability in relation to its severity rating and security impact, please see the Exploitability Index in the February bulletin summary.
**Operating System** | [**Microsoft PDF Library Buffer Overflow Vulnerability - CVE-2016-0058**](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-0058) | [**Microsoft Windows Reader Vulnerability - CVE-2016-0046**](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2016-0046) | **Updates Replaced** | |
**Windows 8.1** | ||||
[Windows 8.1 for 32-bit Systems](https://www.microsoft.com/download/details.aspx?familyid=e191962e-7f9d-47d8-88db-65ba9d1a6286) (3123294) | **Critical** Remote Code Execution | **Critical** Remote Code Execution | None | |
[Windows 8.1 for x64-based Systems](https://www.microsoft.com/download/details.aspx?familyid=d470f055-8e7a-46ce-ad87-4ae65b2610b9) (3123294) | **Critical** Remote Code Execution | **Critical** Remote Code Execution | None | |
**Windows Server 2012 and Windows Server 2012 R2** | ||||
[Windows Server 2012](https://www.microsoft.com/download/details.aspx?familyid=a4376aa7-43cb-4a3d-b10c-17934dac1d98) (3123294) | **Critical** Remote Code Execution | **Critical** Remote Code Execution | None | |
[Windows Server 2012 R2](https://www.microsoft.com/download/details.aspx?familyid=7d6fad6f-8293-415f-aec4-2ef6610f4154) (3123294) | **Critical** Remote Code Execution | **Critical** Remote Code Execution | None | |
**Windows 10** | ||||
[Windows 10 for 32-bit Systems](https://support.microsoft.com/kb/3135174)[1] (3135174) | **Critical** Remote Code Execution | **Critical** Remote Code Execution | None | |
[Windows 10 for x64-based Systems](https://support.microsoft.com/kb/3135174)[1] (3135174) | **Critical** Remote Code Execution | **Critical** Remote Code Execution | None | |
**Server Core installation option** | ||||
[Windows Server 2012 R2](https://www.microsoft.com/download/details.aspx?familyid=7d6fad6f-8293-415f-aec4-2ef6610f4154) (Server Core installation) (3123294) | **Critical** Remote Code Execution | **Critical** Remote Code Execution | None |
Vulnerability Information
Microsoft Windows Reader Vulnerability - CVE-2016-0046
A remote code execution vulnerability exists in Microsoft Windows when a specially crafted file is opened in Windows Reader. An attacker who successfully exploited this vulnerability could cause arbitrary code to execute in the context of the current user. If a user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.
For an attack to succeed, a user must open a specially crafted Windows Reader file with an affected version of Windows Reader. In an email attack scenario, an attacker would have to convince the user to open a specially crafted Windows Reader file. The update addresses the vulnerability by modifying how Windows Reader parses files.
The following table contains links to the standard entry for each vulnerability in the Common Vulnerabilities and Exposures list:
Vulnerability title | CVE number | Publicly disclosed | Exploited |
Microsoft Windows Reader Vulnerability | CVE-2016-0046 | No | No |
Vulnerability title | CVE number | Publicly disclosed | Exploited |
Microsoft PDF Library Buffer Overflow Vulnerability | CVE-2016-0058 | No | No |