The company plans to release 13 security bulletins next week, but the Internet Explorer vulnerability identified on Wednesday won't be among them.
Microsoft on Thursday said that its monthly security patch, to be issued on Tuesday, February 9th, will include 13 security bulletins.
That's the largest number of security bulletins issued in February for the past four years, according to Sheldon Malm, senior director of security strategy at Rapid7.
Next week's patch is scheduled to include five "critical" bulletins. Two of the bulletins affect Microsoft Office, and eleven affect Microsoft Windows.
Malm notes that all of Microsoft's operating systems, including Vista and Windows 7, will get fixes. "I won't be surprised if Microsoft is playing catch-up on some lingering vulnerabilities from last year," he said in an e-mailed statement.
One vulnerability that won't be fixed this month can be found in Internet Explorer. Microsoft on Wednesday issued a security advisory, stating that it is investigating a publicly reported vulnerability in versions of its Web browser.
"Our investigation so far has shown that if a user is using a version of Internet Explorer that is not running in Protected Mode an attacker may be able to access files with an already known filename and location," Microsoft's advisory says.
Core Security says that in order to exploit the Internet Explorer vulnerability, an attacker would only have to entice a user to click on a URL or visit a malicious Web site, without any other interaction. A successful attacker would gain the ability to read files on the user's system but couldn't run arbitrary code without restrictions.
Microsoft lists a number of mitigating factors which could limit attempts to exploit this vulnerability.
Last month, Microsoft issued an emergency, or out-of-band, security patch for Internet Explorer. The patch addressed a vulnerability said to have been used in a cyber attack from China on Google and a number of other companies.
Read more about:
2010About the Author(s)
You May Also Like
Securing Code in the Age of AI
April 24, 2024Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024