Critical flaws haunt Microsoft Office, IE browser

Microsoft dropped its largest ever batch of security patches today to cover a record 49 security vulnerabilities, including several browser flaws that could expose Internet Explorer users to drive-by malware downloads.

The Internet Explorer bulletin (MS10-071) fixes a total of 12 vulnerabilities and because of the risk of zero-click drive-by download attacks, Microsoft is urging Windows users to apply this patch immediately.

Windows users should also pay special attention to MS10-076, which covers a serious flaw in the way the operating system handles embedded OpenType (EOT) fonts. This update is rated “critical” for all versions of Windows (including Windows 7 and Windows Server 2008) and can be exploited to launch remote code execution attacks if a computer user simply surfs to a booby trapped Web site.

Microsoft also urged system administrators to treat these bulletins with the highest priority:

* MS10-077: Addresses a vulnerability in .NET Framework that could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs). This bug only affects 64-bit systems on all supported versions of Windows.
* MS10-075: Fixes a vulnerability in Windows Media Player that could be exploited via malicious RTSP network packets to Windows Vista and Windows 7 client on the same network. This only affects Windows users who has opted-in to Windows Media Network Sharing service. However, keep in mind that Windows 7 Home Edition opts-in by default.

The Microsoft Office productivity suite also underwent a major security makeover in this month’s patch batch. continue reading

Comments

Popular posts from this blog

KEPONG Gangster甲洞

SNSD’s album was postponed to June 29.

Singaporean arrested for FB attack on govt