Microsoft has a small Patch Tuesday planned for this month. The company said it will ship two security bulletins on 11 May to fix vulnerabilities in Windows, Office and Visual Basic for Applications. Both bulletins are rated critical and cover vulnerabilities that leave users open to remote code execution by attackers.
“Windows 7 and Windows Server 2008 R2 customers will be offered the Windows-related update but they are not vulnerable in their default configurations,” noted Jerry Bryant, group manager of Response Communications for Microsoft Security Response Center.
Missing from the lineup is a patch for a cross-site scripting flaw affecting Office SharePoint 2007 and Windows SharePoint Services 3.0 that was reported the week of April 26. Bryant said the company is still working on an update to address the issue, and recommended that users try the workaround contained in the advisory issued April 29.
The SharePoint vulnerability permits escalation of privileges within the SharePoint site. If an attacker successfully exploits the vulnerability, the attacker could run commands against the SharePoint server with the privileges of the compromised user.
According to Microsoft, Internet Explorer 8 users browsing to a SharePoint site in the Internet Zone are at a reduced risk because the XSS Filter in IE 8 prevents this attack by default. The XSS Filter is not enabled by default in the Intranet Zone, however.
Amazon is reportedly in talks to pump billions of dollars more into AI start-up Anthropic,…
Star witness for the US prosecution of FTX founder Sam Bankman-Fried, has begun her two…
After axing 31 percent of its workforce when it failed to be acquired by Amazon,…
Mozilla Foundation axes 30 percent of its staff, and is eliminating its Advocacy Division that…
Improving security. Mandatory multi-factor authentication (MFA) is coming to the Google Cloud by the end…
New AI assurance platform from UK government will help businesses ensure they can safely develop…