Vulnerabilities / Threats

05:10 PM
Connect Directly

Microsoft Fixes Nine Vulnerabilities In July Patch

Two zero-day vulnerabilities are addressed in Microsoft's July patch cycle, but a third flaw that was revealed on Monday remains.

Microsoft on Tuesday released six security bulletins addressing nine different vulnerabilities in its software as part of its monthly patch cycle.

The July crop of patches includes three bulletins designated "critical" and three bulletins designated "important."

Affected software includes Windows, Microsoft Office, Internet Security and Acceleration (ISA) Server, Virtual PC and Virtual Server.

Two of the "critical" bulletins address vulnerabilities in the Microsoft's Video ActiveX Control and DirectShow component. Microsoft warned customers about these "browse-and-get-owned" vulnerabilities in July and May, respectively.

"Today's release is important because patches were released for two recent zero-day attacks -- a QuickTime file parsing vulnerability and the recently announced DirectShow vulnerability," said Eric Schultze, CTO of Shavlik. "Both vulnerabilities are reported as being actively exploited on the Internet."

The third "critical" bulletin provides a fix for a vulnerability in the Embedded OpenType Font Engine, which is used in all versions of Windows, including Vista and Windows Server 2008.

On Monday, Microsoft issued a Security Advisory about a vulnerability in Office Web Components Spreadsheet ActiveX software. No fix for this vulnerability was included in Microsoft's July patch, though the company has provided Fit-It link that disables the vulnerable component as a workaround.

The "important" bulletins include a vulnerability in Microsoft proxy server ISA 2006. "As administrator usernames are often easy to guess this vulnerability deserves special attention, if IT organizations are using ISA with the Radius configuration," said Qualys CTO Wolfgang Kandek in an e-mailed statement.

The second "important" bulletin covers a vulnerability in the Publisher component of Office 2007. And the third fixes a privilege elevation flaw in Virtual PC and Virtual Server.

Black Hat is like no other security conference. It happens in Las Vegas, July 25-30. Find out more and register.

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Who Does What in Cybersecurity at the C-Level
Steve Zurier, Freelance Writer,  3/16/2018
New 'Mac-A-Mal' Tool Automates Mac Malware Hunting & Analysis
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/14/2018
(ISC)2 Report: Glaring Disparity in Diversity for US Cybersecurity
Kelly Jackson Higgins, Executive Editor at Dark Reading,  3/15/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.