Categories: PCSecurityWorkspace

Microsoft Plans Two Fixes For Patch Tuesday

Microsoft has a small Patch Tuesday planned for this month. The company said it will ship two security bulletins on 11 May to fix vulnerabilities in Windows, Office and Visual Basic for Applications. Both bulletins are rated critical and cover vulnerabilities that leave users open to remote code execution by attackers.

“Windows 7 and Windows Server 2008 R2 customers will be offered the Windows-related update but they are not vulnerable in their default configurations,” noted Jerry Bryant, group manager of Response Communications for Microsoft Security Response Center.

No SharePoint fix

Missing from the lineup is a patch for a cross-site scripting flaw affecting Office SharePoint 2007 and Windows SharePoint Services 3.0 that was reported the week of April 26. Bryant said the company is still working on an update to address the issue, and recommended that users try the workaround contained in the advisory issued April 29.

The SharePoint vulnerability permits escalation of privileges within the SharePoint site. If an attacker successfully exploits the vulnerability, the attacker could run commands against the SharePoint server with the privileges of the compromised user.

According to Microsoft, Internet Explorer 8 users browsing to a SharePoint site in the Internet Zone are at a reduced risk because the XSS Filter in IE 8 prevents this attack by default. The XSS Filter is not enabled by default in the Intranet Zone, however.

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

Amazon Mulls New Multi-Billion Dollar Investment In Anthropic – Report

Amazon is reportedly in talks to pump billions of dollars more into AI start-up Anthropic,…

2 hours ago

FTX’s Caroline Ellison Begins Her Two Year Prison Sentence

Star witness for the US prosecution of FTX founder Sam Bankman-Fried, has begun her two…

3 hours ago

More Layoffs For iRobot Staff After Abandoned Amazon Deal

After axing 31 percent of its workforce when it failed to be acquired by Amazon,…

20 hours ago

Mozilla Foundation Confirms Layoffs, Eliminates Advocacy Division

Mozilla Foundation axes 30 percent of its staff, and is eliminating its Advocacy Division that…

21 hours ago

Google To Make MFA Mandatory Next Year

Improving security. Mandatory multi-factor authentication (MFA) is coming to the Google Cloud by the end…

22 hours ago

UK Government Launch AI Safety Platform For Businesses

New AI assurance platform from UK government will help businesses ensure they can safely develop…

23 hours ago