|
Security Alerts |
|
Microsoft Security Content: Comprehensive Edition
|
Microsoft Security Content: Comprehensive Edition
|
|
-
Microsoft Security Bulletin Summary for August 2010
Revision Note: V2.1 (September 1, 2010): Added note for MS10-056 to inform customers using Word 2007 that in addition to security update package KB2251419, they also need to install the security update package KB2277947.Summary: This bulletin summary lists security bulletins released for August 2010.
-
MS10-056 - Critical: Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (2269638) - Version:1.3
Severity Rating: Critical - Revision Note: V1.3 (September 1, 2010): Added note to the affected software table to inform customers using Word 2007 that in addition to security update package KB2251419, they also need to install the security update package KB2277947 to be protected from the vulnerabilities described in this bulletin.Summary: This security update resolves four privately reported vulnerabilities in Microsoft Office. The most severe vulnerabilities could allow remote code execution if a user opens or previews a specially crafted RTF e-mail message. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
-
MS10-049 - Critical: Vulnerabilities in SChannel could allow Remote Code Execution (980436) - Version:1.1
Severity Rating: Critical - Revision Note: V1.1 (September 1, 2010): Corrected the bulletin replacement information for this update. This is an informational change only. There were no changes to the detection logic or the update files.Summary: This security update resolves one publicly disclosed vulnerability and one privately reported vulnerability in the Secure Channel (SChannel) security package in Windows. The more severe of these vulnerabilities could allow remote code execution if a user visits a specially crafted Web site that is designed to exploit these vulnerabilities through an Internet Web browser. In all cases, however, an attacker would have no way to force users to visit these Web sites. Instead, an attacker would have to convince users to visit the Web site, typically by getting them to click a link in an e-mail message or in an Instant Messenger message that takes users to the attacker's Web site.
-
Microsoft Security Advisory (2269637): Insecure Library Loading Could Allow Remote Code Execution
Revision Note: V1.1 (August 31, 2010) Added a link to Microsoft Knowledge Base Article 2264107 to provide an automated Microsoft Fix it solution for the workaround, Disable loading of libraries from WebDAV and remote network shares.Summary: Microsoft is aware that research has been published detailing a remote attack vector for a class of vulnerabilities that affects how applications load external libraries.
-
MS10-054 - Critical: Vulnerabilities in SMB Server Could Allow Remote Code Execution (982214) - Version:1.2
Severity Rating: Critical - Revision Note: V1.2 (August 25, 2010): Removed erroneous reference to a Microsoft Fix it solution from the workarounds for SMB Stack Exhaustion Vulnerability - CVE-2010-2552.Summary: This security update resolves several privately reported vulnerabilities in Microsoft Windows. The most severe of these vulnerabilities could allow remote code execution if an attacker created a specially crafted SMB packet and sent the packet to an affected system. Firewall best practices and standard default firewall configurations can help protect networks from attacks originating outside the enterprise perimeter that would attempt to exploit these vulnerabilities.
|
|
Security Alerts 