Determina patches latest Microsoft flaw
116542
(InfoWorld) - For the second week in a row, independent security researchers have fixed a hole in Microsoft Corp.'s software. On Friday, Determina Inc.Â published a free patch for a critical bug in an ActiveX control (called WebViewFolderIcon) that is used by Windows' graphical user interface. Security experts consider the flaw to be critical because it could be exploited by attackers to run unauthorized code on a victim's PC. To make this happen, the victim would have to visit a Web site with Internet Explorer (IE) and allow it to run a malicious ActiveX control. Security researcher HD MooreÂ published details of the bug on July 18, but he recently added attack code that exploited the flaw to his widely-used Metasploit hacking toolkit. Determina says that the availability of the Metasploit code has boosted the risk of attacks. There seems to be no shortage of Windows attacks this week. On Tuesday, MicrosoftÂ issued a rare emergency patch for a separate problem in Outlook and IE's Vector Markup Language (VML) rendering engine, after that flaw was widely exploited by attackers. And criminals have also launched extremely limited attacks that exploit an unpatched flaw in PowerPoint. The VML flaw had first been fixed four days ahead of Microsoft's patch by a group of security researchers calling themselves the Zeroday Emergency Response Team. This latest bug is not likely to be as widely exploited as the VML vulnerability, Moore said. "This bug is not as severe as the VML flaw, since it depends on ActiveX, and would not be exploitable by default through Outlook," he said in an e-mail. Nevertheless, Microsoft found the issue to be serious enough to meritÂ a security advisory, published Thursday. Microsoft plans to patch the WebViewFolderIcon flaw in its next scheduled set of security updates, due Oct. 10. So far, Microsoft doesn't know of "any attacks attempting to use the reported vulnerability or of customer impact at this time," the security advisory states. Microsoft does not recommend that users install third-party patches, because this software has not gone through the rigorous quality assurance testing process that Microsoft applies to its security updates. Determina's patch works on Windows 2000, XP and 2003 systems. Â
338092
Microsoft is working to patch a security flaw in its word-processing software that is being used in targeted cyberattacks.
461708
Microsoft published on Tuesday a patch for a major security flaw in its software&#39;s handling of the JPEG graphics format and urged customers to use a new tool to locate the many applications that are vulnerable.
555449
Microsoft this week released a patch to fix an important vulnerability in Internet Explorer, even as a new worm that took advantage of an as-yet-unpatched hole in the Web browser spread.
416384
Microsoft Corp. released two security fixes Tuesday that carry its most severe threat rating, including one that applies even to computers that have downloaded the company's massive security update for the Windows XP operating system.
362606
Microsoft issued a patch for a vulnerability in its server software that could allow an attacker to spoof trusted Internet content.
96676
Microsoft on Wednesday released an update to Internet Explorer (IE) to fix a security flaw that was discovered a month ago and has since been exploited to attack users.
213499
Update to "critical" Internet Explorer patch repairs a serious security flaw introduced by the original version.
55054
Microsoft issues fixes for more than 20 holes in its software in its February security update.
751327
The patches released Tuesday mend four software holes in Microsoft Corp Windows operating system, including one flaw that can affect machines equipped with a massive security upgrade the company released five months ago.-The Washington Post
79374
Microsoft Corp. today released an unprecedented number of software security updates to plug flaws in its products, including seven "critical" defects that it said hackers could use to hijack vulnerable computers running the Windows operating system.
543022
Code that exploits a serious, yet-to-be-patched hole in Microsoft's Web browser has been posted on the Net.
586376
Microsoft Corp.  on Tuesday  released a security patch to fix a "critical" hole in its  Internet Explorer Web browser that the world's biggest software  maker said could allow an attacker to take control of a user's  computer.
549959
Microsoft Corp. today released an unprecedented number of software security updates to plug flaws in its products, including seven &quot;critical&quot; defects that it said hackers could use to hijack
609685
Microsoft today released an out-of-cycle security bulletin and patch for a critical hole in Internet Explorer that is already being widely exploited by attackers.
632521
Better install Microsoft's latest patches--hackers have posted attack code to exploit the flaws in Works.
225526
.NET, Active Directory and Excel flaws patched up Microsoft's latest Patch Tuesday update brought six patches, three of which Redmond described as critical fixes.â¦