December 8, 2016

Microsoft Fixes Three Critical Issues

(LiveHacking.Com) – Microsoft has issued updates for May’s Patch Tuesday covering vulnerabilities in Microsoft Windows, Office, .NET Framework, and Silverlight. There are a total of seven security bulletins, three Critical and four Important, which address 23 issues.

The first of the Critical level updates is MS12-034, which affects Microsoft Office, Windows, .NET Framework, and Silverlight. This security update addresses 10 issues, the most severe of which could allow remote code execution if a user opens a specially crafted document or visits a malicious webpage that embeds TrueType font files.

Microsoft Word is also affected by another Critical issue that could allow remote code execution. MS12-029 addresses a privately reported vulnerability in the processing of RTF files. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

The third, and final, Critial level update, MS12-035, fixes two remote code execution vulnerabilities in the .NET Framework. The two privately reported vulnerabilities could allow remote code execution on a client system if a user views a specially crafted webpage using a web browser that can run XAML Browser Applications (XBAPs). Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

The remaining four bulletins are as follows:

  • MS12-030 – Vulnerabilities in Microsoft Office Could Allow Remote Code Execution – This security update resolves one publicly disclosed and five privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a user opens a specially crafted Office file. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the logged-on user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
  • MS12-031 – Vulnerability in Microsoft Visio Viewer 2010 Could Allow Remote Code Execution – This security update resolves a privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted Visio file. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
  • MS12-032 – Vulnerability in TCP/IP Could Allow Elevation of Privilege – This security update resolves one privately reported and one publicly disclosed vulnerability in Microsoft Windows. The more severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application.
  • MS12-033 – Vulnerability in Windows Partition Manager Could Allow Elevation of Privilege – This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

 

Share and Enjoy:
  • Print
  • Digg
  • StumbleUpon
  • del.icio.us
  • Facebook
  • Yahoo! Buzz
  • Twitter
  • Google Bookmarks