News

Big Security Patch Expected on Tuesday

Expect a whopper patch next week, as Microsoft is planning to release 11 fixes in its April security update.

The April patch may contain five "critical" fixes, plus five "important" ones, as well as one "moderate" fix. As usual, remote code execution (RCE) exploit considerations dominate the slate. Eight of the patches deal with RCE risks, while spoofing, elevation-of-privilege and denial-of-service vulnerabilities are among the other system stressors.

Tuesday's patch will address 25 vulnerabilities in Windows, Microsoft Office and Microsoft Exchange, according to Microsoft Security Response Center spokesman Jerry Bryant.

Bryant also said that a vulnerability in VBScript that could allow RCE attacks and a denial-of-service hole in Redmond's Server Message Block (SMB) Windows component would both be addressed with next week's patch.

The Internet Explorer flaw exploited at this year's Pwn2Own contest will not be patched this month. It's likely that there won't be another IE patch until May and beyond. Microsoft had issued a cumulative out-of-band patch for Internet Explorer just last week.

Critical Bulletins
All of the critical bulletins are Windows operating system fixes with RCE considerations.

The first two critical fixes affect every supported version of Windows operating systems, including Windows 7. Meanwhile, critical fix No. 3 only touches Windows 2000 Server Service.

The fourth critical hotfix affects every OS except Windows 7 and Windows Server 2008. The fifth and final critical security bulletin covers Windows 2000 and Windows XP.

Important and Moderate Bulletins
Important fixes Nos. 1 and 2 affect every supported Windows OS and also plug holes in Windows-based programs.

Important fix No. 3 addresses Microsoft Office. Affected versions include Microsoft Office XP, as well as Microsoft Office 2003 and 2007 versions.

The fourth important bulletin is yet another Windows fix. It covers every supported OS with the exception of Vista and Windows 7. It also touches several versions of Microsoft's Exchange Server, such as Exchange Server 2000, 2003, 2007 and 2010.

The last important bulletin of the slate is another Office hotfix, covering Microsoft Office XP, Microsoft Office 2003 and Microsoft Office 2007.

Rounding out the April slate is the lone moderate bulletin, which is described as a Windows fix that affects every OS except Windows 2000 and Windows 7.

Microsoft also provides a means for IT pros to check out nonsecurity updates delivered via Windows Update and Microsoft Update. The details are described in this Knowledge Base article.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.

Featured

  • Microsoft Appoints Althoff as New CEO for Commercial Business

    Microsoft CEO and chairman Satya Nadella on Wednesday announced the promotion of Judson Althoff to CEO of the company's commercial business, presenting the move as a response to the dramatic industrywide shifts caused by AI.

  • Broadcom Revamps VMware Partner Program Again

    Broadcom recently announced a significant update regarding its VMware Cloud Service Provider (VCSP) program, coinciding with the release of VMware Cloud Foundation (VCF) 9.0, a key component in Broadcom’s private cloud strategy.

  • Closeup of the new Copilot keyboard key

    Microsoft Updates Copilot To Add Context-Sensitive Agents to Teams, SharePoint

    Microsoft has rolled out a new public preview for collaborative "always on" agents in Microsoft 365 Copilot, bringing enhanced, context-aware tools into Teams channels, meetings, SharePoint sites, Planner workstreams and Viva Engage communities.

  • Windows 365 Cloud Apps Now Available for Public Preview

    Microsoft announced this week that Windows 365 Cloud Apps are now available for public preview. This aims to allow IT administrators to stream individual Windows applications from the cloud, removing the need to assign Cloud PCs to every user.