Microsoft Security

download.microsoft.com · Undated · Licence: not cleared; local research copy only

Read the original ↗

CVEs this report names

39 CVEs

CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability
Microsoft · MSCOMCTL.OCXKEVRansomwarePublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution15 reports
>99.9%Top 0.02%
89.2priority
CVE-2014-6332Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution5 reports
94.9%Top 0.14%
89.1priority
CVE-2010-0840Oracle JRE Unspecified Vulnerability
Oracle · Java Runtime Environment (JRE)KEVPublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter2 reports
96.3%Top 0.12%
86.0priority
CVE-2012-0507Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Oracle · Java SEKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing Application T1211Exploitation for Stealth+1 more · 2 reports
98.2%Top 0.09%
86.0priority
CVE-2015-0311Adobe Flash Player Remote Code Execution Vulnerability
Adobe · Flash PlayerKEVPublic exploitCritical · 9.82 reports
85.6%Top 0.28%
85.9priority
CVE-2010-0188Adobe Reader and Acrobat Arbitrary Code Execution Vulnerability
Adobe · Reader and AcrobatKEVRansomwarePublic exploitHigh · 7.8T1189Drive-by Compromise T1105Ingress Tool Transfer2 reports
88.2%Top 0.23%
84.5priority
CVE-2016-1019Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe · Flash PlayerKEVRansomwareCritical · 9.8T1105Ingress Tool Transfer T1486Data Encrypted for Impact4 reports
22.3%Top 2.3%
83.4priority
CVE-2016-0189Microsoft Internet Explorer Memory Corruption Vulnerability
Microsoft · Internet ExplorerKEVRansomwarePublic exploitHigh · 7.5T1189Drive-by Compromise T1059.007JavaScript1 report
94.1%Top 0.15%
82.1priority
CVE-2015-8651Adobe Flash Player Integer Overflow Vulnerability
Adobe · Flash PlayerKEVHigh · 8.8T1189Drive-by Compromise T1105Ingress Tool Transfer+1 more · 3 reports
67.7%Top 0.69%
81.8priority
CVE-2010-2568Microsoft Windows Remote Code Execution Vulnerability
Microsoft · WindowsKEVPublic exploitHigh · 7.8T1204.001Malicious Link T1059Command and Scripting Interpreter4 reports
89.6%Top 0.21%
77.4priority
CVE-2015-1671Microsoft Windows Remote Code Execution Vulnerability
Microsoft · WindowsKEVHigh · 7.8T1204.002Malicious File T1059Command and Scripting Interpreter1 report
48.8%Top 1.1%
77.1priority
CVE-2011-0611Adobe Flash Player Remote Code Execution Vulnerability
Adobe · Flash PlayerKEVPublic exploitHigh · 8.8T1204.002Malicious File T1105Ingress Tool Transfer3 reports
99.4%Top 0.06%
76.9priority
CVE-2012-1889Microsoft XML Core Services Memory Corruption Vulnerability
Microsoft · XML Core ServicesKEVPublic exploitHigh · 8.8T1189Drive-by Compromise T1059Command and Scripting Interpreter+1 more · 3 reports
83.5%Top 0.32%
76.8priority
CVE-2015-0313Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash PlayerKEVPublic exploitCritical · 9.82 reports
95.3%Top 0.13%
76.0priority
CVE-2016-0167Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32kKEVRansomwareHigh · 7.8T1068Exploitation for Privilege Escalation1 report
5.7%Top 7%
75.9priority
CVE-2013-1493The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41…
Public exploit1 report
86.2%Top 0.27%
75.2priority
CVE-2015-5119Adobe Flash Player Use-After-Free Vulnerability
Adobe · Flash PlayerKEVPublic exploitEnd of lifeCritical · 9.8T1566.002Spearphishing Link T1059.007JavaScript+3 more · 5 reports
98.6%Top 0.08%
74.8priority
CVE-2011-1823Android OS Privilege Escalation Vulnerability
Android · Android OSKEVPublic exploitHigh · 7.8T1059Command and Scripting Interpreter T1068Exploitation for Privilege Escalation2 reports
41.4%Top 1.3%
74.3priority
CVE-2012-1723Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability
Oracle · Java SEKEVRansomwarePublic exploitEnd of lifeCritical · 9.8T1190Exploit Public-Facing Application T1059Command and Scripting Interpreter4 reports
93.6%Top 0.16%
73.8priority
CVE-2016-4117Adobe Flash Player Arbitrary Code Execution Vulnerability
Adobe · Flash PlayerKEVRansomwarePublic exploitEnd of lifeCritical · 9.8T1105Ingress Tool Transfer3 reports
94.3%Top 0.15%
72.6priority
CVE-2010-1297Adobe Flash Player Memory Corruption Vulnerability
Adobe · Flash PlayerKEVPublic exploitHigh · 7.8T1189Drive-by Compromise T1204.002Malicious File+1 more · 1 report
82.5%Top 0.34%
72.3priority
CVE-2014-1761Microsoft Word Memory Corruption Vulnerability
Microsoft · WordKEVPublic exploitHigh · 7.8T1204.002Malicious File T1203Exploitation for Client Execution1 report
77.7%Top 0.43%
72.2priority
CVE-2016-0165Microsoft Win32k Privilege Escalation Vulnerability
Microsoft · Win32kKEVPublic exploitHigh · 7.8T1068Exploitation for Privilege Escalation1 report
13.7%Top 3.5%
71.6priority
CVE-2013-0422Oracle JRE Remote Code Execution Vulnerability
Oracle · Java Runtime Environment (JRE)KEVRansomwarePublic exploitEnd of lifeCritical · 9.8T1059Command and Scripting Interpreter2 reports
97.0%Top 0.11%
71.0priority
CVE-2013-2551Microsoft Internet Explorer Use-After-Free Vulnerability
Microsoft · Internet ExplorerKEVRansomwarePublic exploitEnd of lifeHigh · 8.8T1189Drive-by Compromise T1203Exploitation for Client Execution2 reports
73.9%Top 0.52%
70.2priority
CVE-2013-0074Microsoft Silverlight Double Dereference Vulnerability
Microsoft · SilverlightKEVRansomwarePublic exploitEnd of lifeHigh · 7.8T1189Drive-by Compromise T1059Command and Scripting Interpreter2 reports
78.9%Top 0.41%
69.5priority
CVE-2016-1010Adobe Flash Player and AIR Integer Overflow Vulnerability
Adobe · Flash Player and AIRKEVHigh · 8.8T1574Hijack Execution Flow1 report
19.3%Top 2.7%
67.5priority
CVE-2013-2460Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier…
Public exploitT1190Exploit Public-Facing Application T1211Exploitation for Stealth2 reports
70.0%Top 0.62%
67.4priority
CVE-2016-0034Microsoft Silverlight Runtime Remote Code Execution Vulnerability
Microsoft · SilverlightKEVRansomwareEnd of lifeHigh · 8.8T1189Drive-by Compromise T1059Command and Scripting Interpreter+1 more · 3 reports
69.4%Top 0.64%
66.8priority
CVE-2013-3896Microsoft Silverlight Information Disclosure Vulnerability
Microsoft · SilverlightKEVPublic exploitEnd of lifeMedium · 5.5T1189Drive-by Compromise T1005Data from Local System1 report
68.0%Top 0.68%
65.6priority
CVE-2012-0056The mem_write function in the Linux kernel before 3.2.2, when ASLR is disabled, does not properly check permissions…
Public exploit1 report
10.8%Top 4.2%
64.8priority
CVE-2013-2423Oracle JRE Unspecified Vulnerability
Oracle · Java Runtime Environment (JRE)KEVPublic exploitEnd of lifeLow · 3.7T1211Exploitation for Stealth1 report
85.2%Top 0.29%
64.4priority
CVE-2015-0072Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass…
Public exploit1 report
71.7%Top 0.58%
64.4priority
CVE-2008-2551The DownloaderActiveX Control (DownloaderActiveX.ocx) in Icona SpA C6 Messenger 1.0.0.1 allows remote attackers to…
Public exploit1 report
46.9%Top 1.2%
64.3priority
CVE-2015-0310Adobe Flash Player ASLR Bypass Vulnerability
Adobe · Flash PlayerKEVEnd of lifeHigh · 7.8T1189Drive-by Compromise2 reports
15.1%Top 3.3%
63.9priority
CVE-2010-3653The Director module (dirapi.dll) in Adobe Shockwave Player before 11.5.9.615 allows remote attackers to execute…
Public exploit1 report
74.6%Top 0.5%
63.8priority
CVE-2010-3336Microsoft Office XP SP3, Office 2004 and 2008 for Mac, Office for Mac 2011, and Open XML File Format Converter for Mac…
2 reports
23.9%Top 2.2%
61.4priority
CVE-2011-0097Integer underflow in Microsoft Excel 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML…
1 report
31.6%Top 1.7%
59.6priority
CVE-2016-4171Adobe Flash Player Remote Code Execution Vulnerability
Adobe · Flash PlayerKEVEnd of lifeCritical · 9.8T1059Command and Scripting Interpreter1 report
20.1%Top 2.6%
53.2priority

Where it names them

CVE-2012-0158

 CVE-2012-0158 is a remote code execution in Windows Common Controls

Original ↗

CVE-2012-0158

Original ↗

CVE-2012-0158, 62

Original ↗

CVE-2014-6332

ams 0.00% 0.05% 0.10% 0.15% 0.20% 0.25% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/CplLnk (see below) 0.000% 0.001% 0.002% 0.003% 0.004% 0.005% 0.006% 0.007% 0.008% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Unix/Lotoor CVE-2014-6332

Original ↗

 CVE-2014-6332 is a vulnerability in Windows Object Linking and Embedding

Original ↗

address CVE-2014- 6332.

Original ↗

63 CVE-2011-1823, 60, 61 CVE-2012-0056, 60 CVE-2012-0158, 62 CVE-2012-0507, 57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332,

Original ↗

CVE-2010-0840

CVE-2010-0840

Original ↗

 CVE-2010-0840 is a JRE vulnerability that was first disclosed in March 2010

Original ↗

CVE-2010-0840, 57

Original ↗

CVE-2012-0507

nt Internet Explorer security updates released in 2014 added an isolated heap mechanism and a 0.000% 0.002% 0.004% 0.006% 0.008% 0.010% 0.012% 0.014% 0.016% 0.018% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) CVE-2012-1723 CVE-2010-0840 CVE-2013-0422 Obfuscator CVE-2012-0507

Original ↗

 CVE-2012-0507 allows an unsigned Java applet to gain

Original ↗

CVE-2012-0507, 57

Original ↗

CVE-2015-0311

(CVE-2013-2551), Adobe Flash Player (CVE-2015-0310, CVE-2015-0311, and

Original ↗

Adobe Flash Player (CVE-2015-8651 and CVE-2015-0311), Java (CVE-2013-

Original ↗

62 CVE-2012-0507, 57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311,

Original ↗

CVE-2010-0188

files containing a malicious JavaScript that targets CVE-2010-0188 and other

Original ↗

to address CVE-2010-0188.

Original ↗

CVE-2010-0188, 62

Original ↗

CVE-2016-1019

new Adobe Flash Player exploits in 1H16, including CVE-2016-4117, CVE- 2016-1019, and CVE-2015-8651.

Original ↗

CVE-2016-1019 Flash “ASNative” type confusion RCE Adobe Flash APSB16-10 (Apr.

Original ↗

 CVE-2016-1019 - Flash Player “ASNative” type confusion: This zero-day

Original ↗

11 Genwei Jiang, “CVE-2016-1019: A New Flash Exploit Included in Magnitude Exploit Kit,” FireEye Threat

Original ↗

Research Blog, April 7, 2016, https://www.fireeye.com/blog/threat-research/2016/04/cve-2016- 1019_a_new.html.

Original ↗

CVE-2016-0189

CVE-2016-0189 VBSCRIPT engine memory corruption RCE

Original ↗

 CVE-2016-0189 - VBScript engine memory corruption: This exploit was

Original ↗

56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313, 56 CVE-2015-5119, 54, 63, 159 CVE-2015-8651, 56, 57 CVE-2016-0034, 66, 67, 69 CVE-2016-0165, 67 CVE-2016-0167, 67, 69 CVE-2016-0189, 67,

Original ↗

CVE-2015-8651

Adobe Flash Player (CVE-2015-8651 and CVE-2015-0311), Java (CVE-2013-

Original ↗

2016-1019, and CVE-2015-8651.

Original ↗

64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313, 56 CVE-2015-5119, 54, 63, 159 CVE-2015-8651, 56,

Original ↗

CVE-2010-2568

For example, the CVE-2010-2568 CplLnk vulnerability has never affected

Original ↗

detected and blocked by Microsoft real-time antimalware products in 1H16, shaded according to relative prevalence Exploit Type 3Q15 4Q15 1Q16 2Q16 JS/Axpergle Exploit kit 0.71% 0.92% 0.53% 0.40% SWF/Netis Adobe Flash Player 0.00% 0.00% 0.27% 0.00% CVE-2010-2568 (CplLnk) Operating system 0.18% 0.24% 0.13%

Original ↗

 CVE-2010-2568 is a vulnerability in Windows Shell.

Original ↗

CVE-2010-2568 by creating a malformed shortcut file—typically

Original ↗

Windows have never been vulnerable to exploits of CVE-2010-2568.

Original ↗

CVE-2015-1671

vulnerabilities, CVE-2015-1671 and CVE-2016-0034.

Original ↗

CVE-2011-0611

new exploit mitigations to Flash Player in recent years, including adopting the Control Flow Guard technology in Windows 10, which makes memory 0.000% 0.005% 0.010% 0.015% 0.020% 0.025% 0.030% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/ShellCode CVE-2010-3653 CVE-2011-0611

Original ↗

CVE-2011-0611, 63

Original ↗

CVE-2012-1889

CVE-2012-1889

Original ↗

 CVE-2012-1889, a memory corruption vulnerability that affects older

Original ↗

CVE-2012-1889, 64

Original ↗

CVE-2015-0313

CVE-2015-0313, among others), and Java (CVE-2013-2460), although exploit

Original ↗

57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313,

Original ↗

CVE-2016-0167

CVE-2016-0167 Win32k!xxxMNDestroyHandler Use-

Original ↗

 CVE-2016-0167 – Microsoft Windows Win32k!xxxMNDestroyHandler Use-

Original ↗

56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313, 56 CVE-2015-5119, 54, 63, 159 CVE-2015-8651, 56, 57 CVE-2016-0034, 66, 67, 69 CVE-2016-0165, 67 CVE-2016-0167, 67,

Original ↗

CVE-2013-1493

2423, CVE-2013-1493, and CVE-2012-1723), and Silverlight (CVE-2013-3896

Original ↗

CVE-2013-1493, 56

Original ↗

CVE-2015-5119

 SWF/Netis uses a critical vulnerability in Adobe Flash Player (CVE-2015-5119)

Original ↗

 SWF/Netis uses a critical vulnerability in Adobe Flash Player (CVE-2015-5119)

Original ↗

An exploit that targets a vulnerability in Adobe Flash Player (CVE- 2015-5119) to download and run files, including malware like

Original ↗

56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313, 56 CVE-2015-5119, 54, 63,

Original ↗

CVE-2011-1823

5% 0.10% 0.15% 0.20% 0.25% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/CplLnk (see below) 0.000% 0.001% 0.002% 0.003% 0.004% 0.005% 0.006% 0.007% 0.008% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Unix/Lotoor CVE-2014-6332 CVE-2011-1823

Original ↗

 CVE-2011-1823 is sometimes called the GingerBreak

Original ↗

exploit for the CVE-2011-1823 vulnerability disguised as an image file.

Original ↗

CVE-2011-1823, 60, 61

Original ↗

See CVE-2011-1823

Original ↗

CVE-2012-1723

2423, CVE-2013-1493, and CVE-2012-1723), and Silverlight (CVE-2013-3896

Original ↗

CVE-2012-1723

Original ↗

 CVE-2012-1723, the most commonly encountered individual Java exploit in

Original ↗

Java vulnerability - CVE-2012-1723” (August 1, 2012) in the Microsoft

Original ↗

CVE-2012-1723, 56, 57, 58, 59

Original ↗

CVE-2016-4117

early May that made use of an exploit for CVE-2016-4117, a vulnerability in

Original ↗

exact same CVE-2016-4117 exploit code that PROMETHIUM used, prior to public

Original ↗

background, a series of events, including the use of the CVE-2016-4117 zero-day

Original ↗

The NEODYMIUM attack chain shows how the exploit CVE-2016-4117 was used to infect target individuals’ computers

Original ↗

The Flash vulnerability CVE-2016-4117 is a type

Original ↗

CVE-2010-1297

Flash Player in recent years, including adopting the Control Flow Guard technology in Windows 10, which makes memory 0.000% 0.005% 0.010% 0.015% 0.020% 0.025% 0.030% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/ShellCode CVE-2010-3653 CVE-2011-0611 SWF/Netis CVE-2010-1297

Original ↗

CVE-2010-1297, 63

Original ↗

CVE-2014-1761

CVE-2014-1761

Original ↗

62 CVE-2011-0611, 63 CVE-2011-1823, 60, 61 CVE-2012-0056, 60 CVE-2012-0158, 62 CVE-2012-0507, 57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761,

Original ↗

CVE-2016-0165

CVE-2016-0165 Win32k!NtGdiPathToRegion EoP Microsoft

Original ↗

57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313, 56 CVE-2015-5119, 54, 63, 159 CVE-2015-8651, 56, 57 CVE-2016-0034, 66, 67, 69 CVE-2016-0165,

Original ↗

CVE-2013-0422

CVE-2013-0422

Original ↗

 CVE-2013-0422 first appeared in January 2013 as a zero-day vulnerability.

Original ↗

CVE-2013-0422 is a package access check vulnerability that allows an

Original ↗

For more information about CVE-2013-0422, see the entry “A technical

Original ↗

analysis of a new Java vulnerability (CVE-2013-0422)” (January 20, 2013) in

Original ↗

CVE-2013-2551

(CVE-2013-2551), Adobe Flash Player (CVE-2015-0310, CVE-2015-0311, and

Original ↗

62 CVE-2010-3653, 63 CVE-2011-0097, 62 CVE-2011-0611, 63 CVE-2011-1823, 60, 61 CVE-2012-0056, 60 CVE-2012-0158, 62 CVE-2012-0507, 57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551,

Original ↗

CVE-2013-0074

number of vulnerabilities in Silverlight (CVE-2013-0074), Internet Explorer

Original ↗

and CVE-2013-0074), among other components.

Original ↗

CVE-2013-0074, 56

Original ↗

CVE-2016-1010

CVE-2016-1010 Flash “copyPixels” integer overflow RCE Adobe Flash APSB16-08 (Mar.

Original ↗

 CVE-2016-1010 - Flash Player “copyPixels” integer overflow: This vulnerability

Original ↗

CVE-2016-1010 was

Original ↗

56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313, 56 CVE-2015-5119, 54, 63, 159 CVE-2015-8651, 56, 57 CVE-2016-0034, 66, 67, 69 CVE-2016-0165, 67 CVE-2016-0167, 67, 69 CVE-2016-0189, 67, 70 CVE-2016-1010,

Original ↗

CVE-2013-2460

CVE-2015-0313, among others), and Java (CVE-2013-2460), although exploit

Original ↗

CVE-2013-2460, 56

Original ↗

CVE-2016-0034

vulnerabilities, CVE-2015-1671 and CVE-2016-0034.

Original ↗

CVE-2016-0034 Silverlight “GetChars()” memory

Original ↗

 CVE-2016-0034 - Silverlight “GetChars()” memory

Original ↗

16 Costin Raiu and Anton Ivanov, “The mysterious case of CVE-2016-0034: the hunt for a Microsoft Silverlight 0-

Original ↗

day,” Securelist, January 13, 2016, https://securelist.com/blog/research/73255/the-mysterious-case-of-cve- 2016-0034-the-hunt-for-a-microsoft-silverlight-0-day/.

Original ↗

CVE-2013-3896

2423, CVE-2013-1493, and CVE-2012-1723), and Silverlight (CVE-2013-3896

Original ↗

63 CVE-2011-0097, 62 CVE-2011-0611, 63 CVE-2011-1823, 60, 61 CVE-2012-0056, 60 CVE-2012-0158, 62 CVE-2012-0507, 57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896,

Original ↗

CVE-2012-0056

3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/CplLnk (see below) 0.000% 0.001% 0.002% 0.003% 0.004% 0.005% 0.006% 0.007% 0.008% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Unix/Lotoor CVE-2014-6332 CVE-2011-1823 (GingerBreak) CVE-2012-0056

Original ↗

CVE-2012-0056, 60

Original ↗

CVE-2013-2423

Adobe Flash Player (CVE-2015-8651 and CVE-2015-0311), Java (CVE-2013- 2423, CVE-2013-1493, and CVE-2012-1723), and Silverlight (CVE-2013-3896

Original ↗

CVE-2013-2423, 56

Original ↗

CVE-2015-0072

 CVE-2015-0072 is a cross-site scripting (XSS) vulnerability in Internet

Original ↗

CVE-2015-0072

Original ↗

60, 61 CVE-2012-0056, 60 CVE-2012-0158, 62 CVE-2012-0507, 57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072,

Original ↗

CVE-2008-2551

CVE-2008-2551

Original ↗

CVE-2008-2551, 64

Original ↗

CVE-2015-0310

(CVE-2013-2551), Adobe Flash Player (CVE-2015-0310, CVE-2015-0311, and

Original ↗

60 CVE-2012-0158, 62 CVE-2012-0507, 57 CVE-2012-1723, 56, 57, 58, 59 CVE-2012-1889, 64 CVE-2013-0074, 56 CVE-2013-0422, 57, 59 CVE-2013-1493, 56 CVE-2013-2423, 56 CVE-2013-2460, 56 CVE-2013-2551, 56 CVE-2013-3896, 56 CVE-2014-1761, 62 CVE-2014-6332, 61 CVE-2015-0072, 64 CVE-2015-0310,

Original ↗

CVE-2010-3653

Adobe to add new exploit mitigations to Flash Player in recent years, including adopting the Control Flow Guard technology in Windows 10, which makes memory 0.000% 0.005% 0.010% 0.015% 0.020% 0.025% 0.030% 3Q15 4Q15 1Q16 2Q16 Encounter rate (percent of all reporting computers) Win32/ShellCode CVE-2010-3653

Original ↗

CVE-2010-3653, 63

Original ↗

CVE-2010-3336

 CVE-2010-3336 is a memory corruption vulnerability in several older

Original ↗

CVE-2010-3336

Original ↗

CVE-2010-3336, 62

Original ↗

CVE-2011-0097

CVE-2011-0097

Original ↗

CVE-2011-0097, 62

Original ↗

CVE-2016-4171

CVE-2016-4171 Flash malformed ExecPolicy tag RCE Adobe Flash APSB16-18 (Jun.

Original ↗

 CVE-2016-4171 – Flash Player malformed ExecPolicy tag: This zero-day

Original ↗

14 Costin Raiu, “CVE-2016-4171 – Adobe Flash Zero-day used in targeted attacks,” Securelist, June 14, 2016,

Original ↗

https://securelist.com/blog/research/75082/cve-2016-4171-adobe-flash-zero-day-used-in-targeted-attacks/.

Original ↗

64 CVE-2015-0310, 56 CVE-2015-0311, 56 CVE-2015-0313, 56 CVE-2015-5119, 54, 63, 159 CVE-2015-8651, 56, 57 CVE-2016-0034, 66, 67, 69 CVE-2016-0165, 67 CVE-2016-0167, 67, 69 CVE-2016-0189, 67, 70 CVE-2016-1010, 67 CVE-2016-1019, 57, 67, 68 CVE-2016-4117, 22, 23, 24, 25, 29, 57, 67, 68 CVE-2016-4171, 67,

Original ↗

Techniques drawn from this report

None

No passage in this report has been tied to an ATT&CK technique.