Categories: PCSecurityWorkspace

Microsoft Plans Two Fixes For Patch Tuesday

Microsoft has a small Patch Tuesday planned for this month. The company said it will ship two security bulletins on 11 May to fix vulnerabilities in Windows, Office and Visual Basic for Applications. Both bulletins are rated critical and cover vulnerabilities that leave users open to remote code execution by attackers.

“Windows 7 and Windows Server 2008 R2 customers will be offered the Windows-related update but they are not vulnerable in their default configurations,” noted Jerry Bryant, group manager of Response Communications for Microsoft Security Response Center.

No SharePoint fix

Missing from the lineup is a patch for a cross-site scripting flaw affecting Office SharePoint 2007 and Windows SharePoint Services 3.0 that was reported the week of April 26. Bryant said the company is still working on an update to address the issue, and recommended that users try the workaround contained in the advisory issued April 29.

The SharePoint vulnerability permits escalation of privileges within the SharePoint site. If an attacker successfully exploits the vulnerability, the attacker could run commands against the SharePoint server with the privileges of the compromised user.

According to Microsoft, Internet Explorer 8 users browsing to a SharePoint site in the Internet Zone are at a reduced risk because the XSS Filter in IE 8 prevents this attack by default. The XSS Filter is not enabled by default in the Intranet Zone, however.

Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Share
Published by
Brian Prince eWEEK USA 2014. Ziff Davis Enterprise Inc. All Rights Reserved

Recent Posts

US Widening AI Lead Over China, Finds Stanford Report

US widening lead over China on AI development, as UK places third in Stanford index…

10 hours ago

Amazon To Pump Another $4bn Into AI Start-Up Anthropic

Amazon to invest a further $4bn into AI start-up Anthropic, doubling its investment as it…

11 hours ago

The Cost of Tech Skills

The demand for tech skills is surging, driving economic growth but revealing challenges. Financial costs,…

11 hours ago

Supreme Court Says Meta Must Face Multibillion-Dollar Fraud Lawsuit

US Supreme Court tosses Meta's appeal over Cambridge Analytica-linked investor lawsuit, meaning case must proceed

11 hours ago

Uber Seeks $10m Stake In Pony AI Via IPO

Uber reportedly seeks $10m stake in Chinese autonomous driving firm Pony AI via US IPO,…

12 hours ago

Apple Developing ‘LLM Siri’ AI For 2026

iPhone maker reportedly developing next-generation AI large language model for Siri for spring 2026 as…

12 hours ago