Microsoft Delivers Seven Security Bulletins, Three Critical

Microsoft released seven security bulletins, including fixes for three critical vulnerabilities, as part of its monthly Patch Tuesday update delivered on Dec. 12.

The software giant, based in Redmond, Wash., shipped 11 security patches in total, including a cumulative Internet Explorer bulletin and an update meant to fix a flaw in the Windows Media file format.

The Windows Media update was unexpectedly added to the six bulletins the company said it would forward in its Patch Tuesday preview released on Dec. 8.

The Windows Media vulnerability targeted by the patch, along with a cumulative IE browser bulletin and an update meant to close a glitch in Microsoft’s Visual Studio 2005 software were identified as critical risks, the company’s most severe security rating.

The IE bulletin may be considered the most severe of the critical patches, addressing a script error handling memory corruption in the browser that merited the critical status.

The client-side code execution vulnerability is caused by a memory corruption condition when handling script errors and the company said that computers affected by the glitch could allow for remote code execution and allow hackers to take control of systems running the software.

Microsoft said the critical flaw could be exploited using a specially-crafted Web page designed to attack the issue, which is present in its Internet Explorer 5 and 6, Windows 2000, Windows XP and Windows Server 2003 systems.

Also included in the IE bulletin were fixes for a critical DHTML script function memory corruption vulnerability residing in IE 6 and Windows XP that could allow for remote code execution if exploited.

Also, there were patches for a TIF folder information disclosure vulnerability ranked as important for almost all versions of the browser, and a second TIF folder information disclosure vulnerability that was rated as a moderate security risk.

Microsoft said the Virtual Studio 2005 patch is meant to fix a critical WMI object broker vulnerability in the development package that could allow for remote execution and allow an attacker who successfully exploits this flaw to take complete control of an affected system.

Read the full story on eWEEK.com: Microsoft Delivers Seven Security Bulletins, Three Critical.