Microsoft to patch three critical holes

By

Most vulnerabilities lead to remote code execution.

Microsoft is planning to next week release 14 patches to fix 20 vulnerabilities across its product line, the company announced Thursday.

Microsoft to patch three critical holes

Tuesday's monthly security update, to be released around 10PM AEST, will come with three critical and 11 important bulletins to plug holes in Windows, Office, Internet Explorer, Publisher and Windows Media Player.

Most of the vulnerabilities, if exploited, can lead to remote code execution.

It is unclear if the update will include remediation for an unpatched Windows Kernel vulnerability, disclosed just prior to the November patches, which aids in the spread of the Duqu trojan.

In addition to describing the planned fixes, Angela Gunn, a senior response communications manager for Microsoft Trusworthy Computing, announced in a Thursday blog post that there is now "greater transparency" around the Microsoft Active Protections Program (MAPP).

Under the program, which launched in 2008, Microsoft shares vulnerability details with approved software security providers prior to the monthly fixes being released. This allows security firms to immediately protect their customers once the patches are delivered.

In an effort to achieve more openness, Microsoft decided to tweak the system so that it will list which partners have provided protection within four days of a security advisory being released.

The most recent advisory was released 3 November for the Duqu malware.

"Naturally, not every advisory applies to every partner, so we do not expect them all to report protections in place for every individual advisory," Gunn wrote.

This article originally appeared at scmagazineus.com

Got a news tip for our journalists? Share it with us anonymously here.
Copyright © SC Magazine, US edition
Tags:

Most Read Articles

India's alarm over Chinese spying rocks CCTV makers

India's alarm over Chinese spying rocks CCTV makers

Woolworths' CSO is Optus-bound

Woolworths' CSO is Optus-bound

Hackers abuse modified Salesforce app to steal data, extort companies

Hackers abuse modified Salesforce app to steal data, extort companies

Cyber companies hope to untangle weird hacker codenames

Cyber companies hope to untangle weird hacker codenames

Log In

  |  Forgot your password?