Microsoft gears up for nine patches next week

Microsoft gears up for nine patches next week

Microsoft Thursday said it will release nine security updates next Tuesday, half again as many as last month, targeting flaws in Windows, Office, Internet Explorer (IE) and Virtual PC.

Of the nine bulletins expected Aug. 14, six will be labeled "critical," Microsoft's highest rating, with the remaining three ranked "important." Vulnerabilities slated to be fixed by eight of the nine updates, however, have been pegged as remote code executable, a sure sign that the bugs are very dangerous, and if exploited, could easily allow a PC to be hijacked by hackers.

Microsoft Windows, including Vista, will be the focus of four of the nine updates, with one of those Vista fixes pegged critical. Other critical patches will be provided for Microsoft Office in general, Excel in particular, Visual Basic 6.0 and IE, the company's market-leading browser. Of the bulletins labeled important, fixes will be issued for Windows Vista, Windows Media Player, Virtual PC and Virtual Server and IE.

Vista is especially hard-pressed in the advance notification, which Microsoft posted to its security site early today. Five of the nine, or just over half, of the updates patch Vista or a component of the new operating system, such as IE 7 or Media Player 11.

Four nonsecurity updates that Microsoft considers "high priority" will also post next week via Windows Update, Microsoft Update and Windows Server Update Services. The note did not hint, however, whether the two Vista hot fix packs now available for manual download will be among that group; Microsoft has promised that the performance and reliability hot fixes will offered up through Windows Update, but has refused to say when.

As is its custom, Microsoft gave only partial details of the upcoming updates, making it difficult at best to predict the vulnerabilities being patched. Clues, however, exist.

One of the updates is to patch Microsoft XML Core Services, a service that lets developers use scripting languages such as JavaScript and Visual Basic to access XML documents. The bug (or bugs -- today's advance warning didn't spell out the number) in XML Core Services 5.0 and 6.0 exists in both Office and Windows, said Microsoft. In both Vista and Office 2007, versions of long-standing product lines that Microsoft has touted as their most secure ever, the XML Core Services flaw is rated critical.

XML Core Services has been plugged in the past, most recently in November 2006 when Microsoft patched a bug in the service that was already being exploited in the wild when the fix was issued.

Although Microsoft had patched the service the month before, it missed at least one bug, which was almost immediately put into play by attackers who duped users to malicious Web sites, then exploited the flaw to compromise their computers. It's possible that next week's fix is for yet another vulnerability that Microsoft security team missed when reviewing the code twice last year.

Another of the expected bulletins will fix a flaw in Excel. The affected software, which includes Office 2000, in which the bug is ranked critical, as well as Office XP, Office 2003 and Excel Viewer 2003, points toward an Office file format vulnerability similar to several others of the past 18 months, and as recently as July.

Assuming Microsoft releases all the updates -- occasionally, it drops one at the last minute -- users will have faced 50 bulletins through the first eight months of 2007, one fewer than during the same stretch last year.

If its past practice means anything, Microsoft will post next week's updates on its site between 1 p.m. and 3 p.m. EDT.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?