The Security Bulletins overview for March 2016 provides you with information about security and non-security patches that Microsoft released for supported versions of the Windows operating system and other company products such as Office on the March 2016 Patch Day and after February 2016's Patch Day.
It starts with an executive summary listing the most important information on a glance. What follows is the distribution of updates by operating system and other Microsoft products.
After that, all security bulletins released in March 2016 and all non-security updates are listed, each with links to Microsoft Support pages that you can use for additional research.
You find information on downloading the updates and further resources listed in the last two sections of the overview.
Executive Summary
Operating System Distribution
Windows Vista and Windows Server 2008 are the only operating systems affected by MS16-025 (Security Update for Windows Library Loading to Address Remote Code Execution).
Windows Vista and 7, and Windows Server 2008 and 2008 R2, are affected by MS16-031 ( Security Update for Microsoft Windows to Address Elevation of Privilege) while all newer versions of Windows are not.
The additional critical bulletin listed for Windows 10 is for Microsoft Edge.
Other Microsoft Products
All products are affected by vulnerabilities patched by the security bulletin MS16-029.
Security Bulletins
This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer.
If you are running Windows 7 or 8.1, check out this article which highlights that it includes a new "get Windows 10" offer option.
This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge.
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if Microsoft Windows fails to properly validate input before loading certain libraries. However, an attacker must first gain access to the local system with the ability to execute a malicious application.
This security update resolves vulnerabilities in Microsoft Windows. The more severe of the vulnerabilities could allow remote code execution if an attacker either convinces a user to open a specially crafted document, or to visit a webpage that contains specially crafted embedded OpenType fonts.
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if a user opens specially crafted media content that is hosted on a website.
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if a user opens a specially crafted .pdf file.
This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file.
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow remote code execution if Windows OLE fails to properly validate user input. An attacker could exploit the vulnerabilities to execute malicious code. However, an attacker must first convince a user to open either a specially crafted file or a program from either a webpage or an email message.
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker is able to log on to a target system and run a specially crafted application.
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if the Windows Secondary Logon Service fails to properly manage request handles in memory.
This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker with physical access inserts a specially crafted USB device into the system.
This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application.
This security update resolves a vulnerability in the Microsoft .NET Framework. The security feature bypass exists in a .NET Framework component that does not properly validate certain elements of a signed XML document.
Non-security related updates
How to download and install the March 2016 security updates
You can download the March 2016 security patches and updates for your version of Windows via Windows Update.
This is an automated system that checks for updates regularly, and downloads and installs those that are found automatically or on user-request.
You can run a manual check for updates at any time. To do that, do the following:
Updates are also made available individually on Microsoft's Download Center, and via monthly security ISO images the company releases.
Additional resources
Ghacks is a technology news blog that was founded in 2005 by Martin Brinkmann. It has since then become one of the most popular tech news sites on the Internet with five authors and regular contributions from freelance writers.
KB2952664 Update Compatibility
KB3035583 (GWX.EXE) ??!!
How many times has MS tried to get these onto our systems since last July ??
Persistent little sods aren’t they !!!
Well, they will certainly push it until they end the free upgrade promo, cannot say what will happen afterwards.
“…cannot say what will happen afterwards.”
They will extend the offer.
Thanks.
Any sneaking Win 10 updates?
Yes.
The security update for Internet Explorer KB3139929 information, says it includes nonsecurity-related KB3146449, which “update adds functionality to Internet Explorer 11 on some computers that lets users learn about Windows 10 or start an upgrade to Windows 10.”
See:
http://www.wilderssecurity.com/threads/bork-tuesday-any-problems-yet.370217/page-74#post-2571060
Woody Leonhard on KB3139929 and KB3146449:
http://www.infoworld.com/article/3042155/microsoft-windows/windows-patch-kb-3139929-when-a-security-update-is-not-a-security-update.html
“Update for Windows 8.1 and Windows 7 (KB3035583) – Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1”
This is so blatant, it’s almost comical. Every month this gets re-released so that it will bypass hidden status. FU MS.
Oh, and thank you, Martin, for the info!
edit: had an idea, Martin: in your list, you could highlight updates that are sneaky by putting them in red text!
Wow that is shocking!
KB 3139929, says:
“This security update resolves several reported vulnerabilities in Internet Explorer. The most severe of these vulnerabilities could allow remote code execution if a user views a specially crafted webpage in Internet Explorer… Additionally, this security update includes several nonsecurity-related fixes for Internet Explorer.
Later in the same KB article, Microsoft lists six “nonsecurity-related fixes that are included in this security update,” including this: 3146449 Updated Internet Explorer 11 capabilities to upgrade Windows 8.1 and Windows 7″
So you have to either expose yourself to potential remote code execution or else allow M$ to generate a popup add in IE prompting you to upgrade to Windows 10.
To my mind they have now crossed the bridge and become little more than kidnappers. “If you want security then you’d better let us put whatever we want on your computer”.
Thanks for these reports Martin. I’ll install the other ‘safe’ updates this month (and avoid all use of Internet Explorer ever again) and then after that I won’t be installing any more Windows updates at all.
KB2952664 seems to be forced onto your computer with this latest update.
So even if removed and then hidden as an update, it will auto re-install back onto your computer with no way to remove it permanently…yet. I think this happened with the latest update for this month. The old method of remove and hide no longer works so Microsoft has found a way around that.
So look for it even though you’ve hidden it previously but have installed the latest updates for this month.
Thanks Martin for the news.
Always interesting to receive your newsletter.
Have a good day!