Microsoft's October update to fix 23 flaws

Microsoft expects to release eight patches to address 23 security vulnerabilities in Windows and other products, the company said Thursday.

The bulletins, of which two are rated “critical” and six deemed “important,” are due Tuesday, Oct. 11 at about 2 p.m. EST.

The critical patches will address flaws in Microsoft Windows, Internet Explorer, Silverlight, and the company's .NET framework that could allow for the propagation of an internet worm without user action, according to an advance notification advisory. The important fixes will correct issues that could result in users' data being compromised or cause a denial of service.

One of the important bulletins is particularly interesting because it affects ­Forefront Unified Access Gateway, security software used by employees for remote access, Marcus Carey, security researcher at vulnerability management firm Rapid7, said in a statement sent to SCMagazineUS.com on Thursday.

“No one wants to hear that software that is designed for security is vulnerable to remote code execution,” Carey said. “This bulletin and the related vulnerabilities will definitely pique a lot of attackers' interest. Organizations should keep an eye out for suspicious activity on servers running this software.”

Nearly all of the patches, meanwhile, will require a restart, which will cause widespread disruptions across both internet-connected servers and user community desktops, Paul Henry, security and forensic analyst at vulnerability management firm Lumension, warned in a statement sent to SCMagazineUS.com on Thursday.

Microsoft last month released five security bulletins correcting six vulnerabilities in SharePoint, Excel, Office, Windows and the Windows Internet Name Service (WINS).