Internet Explorer fixes get top billing in Microsoft update

Share this article:

Microsoft on Tuesday released eight fixes to address 23 vulnerabilities that lie across its software and operating system components.

Most notable is bulletin MS11-081, a "critical" patch that closes eight privately reported holes in Internet Explorer (IE) and affects all supported versions, including IE 9. Some of the vulnerabilities can be exploited simply by a user visiting a malicious website.

The only other critical fix is MS11-078, which repairs a privately reported vulnerability in .NET Framework and Silverlight.

"The vulnerability could allow remote code execution on a client system if a user views a specially crafted web page using a web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications," according to Microsoft.

Jason Miller, a researcher at VMware, reminded users that deploying a patch such as MS11-078 may take some time.

"It is important to note that Microsoft .NET Framework patches from Microsoft typically take quite a while to run through the patching process," he said. "The patches can also be quite large for each version of the program."

Vulnerability experts said the six remaining bulletins are considered lower priority. However, at least two of them, MS11-075 and -076, address an issue that Microsoft has been dealing with for more than a year. The software giant has been closing off similar vulnerabilities since last summer, when it issued an advisory after research revealed that a new class of vulnerabilities known as DLL (dynamic-link Library) preloading can be exploited remotely by an attacker who places a malicious library on a network share.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters

More in News

CryptoWall surpasses CryptoLocker in infection rates

CryptoWall surpasses CryptoLocker in infection rates

A threat analysis from Dell SecureWorks CTU says that CryptoWall has picked up where its famous sibling left off.

Professor says Google search, not hacking, yielded medical info

Professor says Google search, not hacking, yielded medical ...

A professor of ethical hacking at City College San Francisco came forward to clarify that he did not demonstrate hacking a medical center's server in a class.

Syrian Malware Team makes use of enhanced BlackWorm RAT

Syrian Malware Team makes use of enhanced BlackWorm ...

FireEye analyzed the hacking group's use of the malware, dubbed the "Dark Edition" of BlackWorm.