Microsoft probes IE 7, Vista bug reports
88476
Two recently disclosed vulnerabilities that affect Internet Explorer 7 and Windows Vista could let hackers nab user data.
277141
Microsoft is looking into reports this week of a serious buffer overflow vulnerability in its Internet Explorer Web browser, but has not yet seen malicious code that exploits the reported flaw.
478094
Security firm Secunia has detailed a new flaw in Internet Explorer that affects users running Windows XP Service Pack 2. The vulnerability involves drag-and-drop, which can be used within a Web page to place a malicious program in the Windows startup folder.
159505
Microsoft Corp. has patched critical flaws in Internet Explorer, Windows Media Player and Visual Basic with its last "Patch Tuesday" release of 2006.
80980
An exploit discovered yesterday by security consultancy Sunbelt and verified by Microsoft this afternoon involving the Vector Markup Language (VML) library in Windows could potentially affect not only users of Internet Explorer, but also of the current beta of Office 2007.
734469
(InfoWorld) - With hackers exploiting unpatched vulnerabilities in its Windows and Office software, Microsoft plans to issue 11 security updates next Tuesday. Some of the Office and Windows updates will be for critical flaws that could be exploited by attackers with no action on the part of users. Six of the patches will be for Windows, and four of them will be for Office, MicrosoftÂ said Thursday in a note on its Web site. The 11th update will be for a flaw in Microsoft's .Net framework, which is considered less severe than the critical Windows and Office patches. Hackers have been keeping Microsoft's Security Response Center busy this past month. Microsoft generally issues its security patches on the second Tuesday of every month, but last weekÂ the company was forced to issue a rare, "out-of-cycle" security patchÂ after criminals began exploiting a flaw in Internet Explorer's VML (Vector Markup Language) rendering engine. And security experts have also warned of cyberattacks based on unpatched flaws in PowerPoint, Word 2000 and in an ActiveX control (called WebViewFolderIcon) used by the Windows' graphical user interface software. The WebViewFolderIcon flaw will be patched Tuesday, Microsoft said. Attacks that take advantage of this flaw have been seen on the Internet, the SANS Internet Storm CenterÂ warned earlier this week. Â
352797
InfoWorld - A security researcher has found a security bug that could be attacked in Internet Explorer. Mozilla said it plans to patch the problem in its next Firefox software update.
535582
More than two months after HD Moore's "Month of Browser Bugs," Microsoft is still scrambling to patch most of the 22 IE vulnerabilities revealed in July -- not to mention the 70 others Moore found in August.
189086
Blog: Within hours of release, veteran researchers find holes in the new Windows browser from Apple.
283001
Microsoft Corp. rushed out a fix Tuesday for a security flaw in its Internet Explorer Web browser after attackers had begun exploiting the vulnerability to take control of computers.
574367
IE exploit code could boost risk of browser mishaps. Microsoft says teamwork makes for better defenses.
106450
The &quot;highly criticial&quot; vulnerability affects Internet Explorer 5.01, 5.5, and 6 on fully patched PCs running either Windows XP SP1 or the newer SP2.
571395
Microsoft issues a third version of a troubled Internet Explorer patch to fix a bug in an earlier update.
715528
Microsoft on Tuesday issued 10 security advisories - seven of them critical - urging consumers and businesses to patch 21 new flaws in Windows software products.
688722
Sample code that exploits a yet-to-be-fixed Windows flaw is circulating. Microsoft plans to deal with it on the next Patch Tuesday.
273091
Security experts are warning of a new and highly critical security flaw in Microsoft (Nasdaq: MSFT) Internet Explorer, when running under Windows XP SP2.
739239
(InfoWorld) - Microsoft Corp. has rolled out its monthly security updates for December, patching critical flaws in Internet Explorer, Windows Media Format, and the Visual Studio 2005 development software. The seven security patches address 11 bugs, including two in the Windows Media Player software. However, no fixes were provided for two Microsoft Word flaws that have been used in a small number of attacks during the past week. Microsoft had said it would release only six patches on Tuesday, but the company added the Windows Media Format update at the last minute, after reports of attacks based on this vulnerability began surfacing. The Windows Media Format is used by Microsoft's Windows Media Player software. In late November, security vendors warned that a buffer overflow error could occur when the Windows Media Player processed ".asx" (Advanced Stream Redirector) media files, meaning that users would first need to be tricked into opening a malicious media file for the attack to work. In its update Tuesday, Microsoft also patched a similar bug in the way the media player processes ".asf" (Advanced Systems Format) files. The Internet Explorer patch fixes four bugs. It is also rated critical, and is noteworthy because some of these bugs will probably begin to be exploited by hackers by week's end, said Gunter Ollmann, director of IBM Corp.'s Internet Security System's X-Force threat analysis service. Enterprise administrators should also pay close attention to an SNMP (Simple Network Monitoring Protocol) patch issued Tuesday, Ollmann said. Microsoft has rated this patch as "important," rather than critical because SNMP is normally blocked at the firewall and turned off by default on Windows systems. However, it is widely deployed as part of the network monitoring infrastructure in the enterprise, and is often used on critical servers, Ollmann said. Ollmann believes this SNMP patch is the "most important" update for enterprise customers. "Since the service is widely deployed in the enterprise and since it's commonly deployed on servers, we think this would be an important attack vector for enterprises," he said. The remaining updates include a "critical" fix for Visual Studio 2005, and "important" updates for Windows and Outlook Express, Microsoft said. Microsoft defines "critical" flaws as bugs that could allow the propagation of an Internet worm without any action on the part of the victim. The company's next set of security updates are due Jan. 9.