Critical flaws haunt Microsoft Office, IE browser
Microsoft dropped its largest ever batch of security patches today to cover a record 49 security vulnerabilities, including several browser flaws that could expose Internet Explorer users to drive-by malware downloads.
The Internet Explorer bulletin (MS10-071) fixes a total of 12 vulnerabilities and because of the risk of zero-click drive-by download attacks, Microsoft is urging Windows users to apply this patch immediately.
Windows users should also pay special attention to MS10-076, which covers a serious flaw in the way the operating system handles embedded OpenType (EOT) fonts. This update is rated “critical” for all versions of Windows (including Windows 7 and Windows Server 2008) and can be exploited to launch remote code execution attacks if a computer user simply surfs to a booby trapped Web site.
Microsoft also urged system administrators to treat these bulletins with the highest priority:
* MS10-077: Addresses a vulnerability in .NET Framework that could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs). This bug only affects 64-bit systems on all supported versions of Windows.
* MS10-075: Fixes a vulnerability in Windows Media Player that could be exploited via malicious RTSP network packets to Windows Vista and Windows 7 client on the same network. This only affects Windows users who has opted-in to Windows Media Network Sharing service. However, keep in mind that Windows 7 Home Edition opts-in by default.
The Microsoft Office productivity suite also underwent a major security makeover in this month’s patch batch. continue reading
The Internet Explorer bulletin (MS10-071) fixes a total of 12 vulnerabilities and because of the risk of zero-click drive-by download attacks, Microsoft is urging Windows users to apply this patch immediately.
Windows users should also pay special attention to MS10-076, which covers a serious flaw in the way the operating system handles embedded OpenType (EOT) fonts. This update is rated “critical” for all versions of Windows (including Windows 7 and Windows Server 2008) and can be exploited to launch remote code execution attacks if a computer user simply surfs to a booby trapped Web site.
Microsoft also urged system administrators to treat these bulletins with the highest priority:
* MS10-077: Addresses a vulnerability in .NET Framework that could allow remote code execution on a client system if a user views a specially crafted Web page using a Web browser that can run XAML Browser Applications (XBAPs). This bug only affects 64-bit systems on all supported versions of Windows.
* MS10-075: Fixes a vulnerability in Windows Media Player that could be exploited via malicious RTSP network packets to Windows Vista and Windows 7 client on the same network. This only affects Windows users who has opted-in to Windows Media Network Sharing service. However, keep in mind that Windows 7 Home Edition opts-in by default.
The Microsoft Office productivity suite also underwent a major security makeover in this month’s patch batch. continue reading
Comments
Post a Comment