ID :IRCNE2013011724
Date: 2013-01-09
Computerworld - Microsoft today patched 12 vulnerabilities in Windows, Office and several server and development products, but as it hinted last week, did not come up with a fix for the Internet Explorer (IE) bug that cyber criminals have been exploiting for at least a month.
Today was also a spring tide of sorts for patching, as Microsoft's updates were just some that vendors pushed to customers. Adobe also issued updates for Flash Player, Adobe Reader and Adobe Acrobat; Google shipped a new version of Chrome; and Mozilla delivered the next iteration of Firefox.
"More vendors are aligning with Patch Tuesday," said Jason Miller, VMware's manager of research and development. "That's not necessarily a bad thing, but with so many, it makes it harder to get your hands around what needs to be patched."
Two of Microsoft's seven security updates were marked "critical," Microsoft's highest-threat rating. The other five were tagged "important." Of the 12 vulnerabilities, only three were critical.
Security experts voted MS13-002, one of the two critical updates, as requiring immediate attention. The one-vulnerability update addressed a bug in XML Core Services (MSXML) in every supported edition of Windows, from the 11-year-old Windows XP to the two-month-old Windows 8 and Windows RT.
MSXML was last patched by MS12-043, another critical update, released in July. That vulnerability was one of several allegedly uncovered, then exploited, by an elite hacker group dubbed "Elderwood" by Symantec, which in September said the gang had an inexhaustible supply of "zero-day" bugs at its disposal.
MS13-002 affected not only Windows, but as Storms and Miller said, also Office 2003 and Office 2007; Expression Web, part of the Expression Studio web development suite; and SharePoint Server 2007, Groove Server 2007 and System Center Operations Manager 2007.
Related Topics
Microsoft's next Patch Tuesday won't resolve IE zero-day flaw
Microsoft issues fix for IE flaw that could allow PC hijack
- 2