Internet Explorer fixes get top billing in Microsoft update

Share this article:

Microsoft on Tuesday released eight fixes to address 23 vulnerabilities that lie across its software and operating system components.

Most notable is bulletin MS11-081, a "critical" patch that closes eight privately reported holes in Internet Explorer (IE) and affects all supported versions, including IE 9. Some of the vulnerabilities can be exploited simply by a user visiting a malicious website.

The only other critical fix is MS11-078, which repairs a privately reported vulnerability in .NET Framework and Silverlight.

"The vulnerability could allow remote code execution on a client system if a user views a specially crafted web page using a web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications," according to Microsoft.

Jason Miller, a researcher at VMware, reminded users that deploying a patch such as MS11-078 may take some time.

"It is important to note that Microsoft .NET Framework patches from Microsoft typically take quite a while to run through the patching process," he said. "The patches can also be quite large for each version of the program."

Vulnerability experts said the six remaining bulletins are considered lower priority. However, at least two of them, MS11-075 and -076, address an issue that Microsoft has been dealing with for more than a year. The software giant has been closing off similar vulnerabilities since last summer, when it issued an advisory after research revealed that a new class of vulnerabilities known as DLL (dynamic-link Library) preloading can be exploited remotely by an attacker who places a malicious library on a network share.

Share this article:

Sign up to our newsletters

More in News

Incapsula mitigates multi-vector DDoS attack lasting longer than a month

Incapsula mitigates multi-vector DDoS attack lasting longer than ...

Incapsula's scrubbing servers were able to filter out more than 50 petabits of malicious DDoS traffic aimed at a video game company for longer than a month.

UPS announces breach impacting 51 U.S. locations

The shipping and printing provider said malware has been present on some stores' computer systems since mid-January.

'Machete' espionage campaign targets orgs in Venezuela, Ecuador

The campaign targets Spanish speaking victims, which also appears to be the native language of attackers.