Big Security Patch Expected on Tuesday

Expect a whopper patch next week, as Microsoft is planning to release 11 fixes in its April security update.

The April patch may contain five "critical" fixes, plus five "important" ones, as well as one "moderate" fix. As usual, remote code execution (RCE) exploit considerations dominate the slate. Eight of the patches deal with RCE risks, while spoofing, elevation-of-privilege and denial-of-service vulnerabilities are among the other system stressors.

Tuesday's patch will address 25 vulnerabilities in Windows, Microsoft Office and Microsoft Exchange, according to Microsoft Security Response Center spokesman Jerry Bryant.

Bryant also said that a vulnerability in VBScript that could allow RCE attacks and a denial-of-service hole in Redmond's Server Message Block (SMB) Windows component would both be addressed with next week's patch.

The Internet Explorer flaw exploited at this year's Pwn2Own contest will not be patched this month. It's likely that there won't be another IE patch until May and beyond. Microsoft had issued a cumulative out-of-band patch for Internet Explorer just last week.

Critical Bulletins
All of the critical bulletins are Windows operating system fixes with RCE considerations.

The first two critical fixes affect every supported version of Windows operating systems, including Windows 7. Meanwhile, critical fix No. 3 only touches Windows 2000 Server Service.

The fourth critical hotfix affects every OS except Windows 7 and Windows Server 2008. The fifth and final critical security bulletin covers Windows 2000 and Windows XP.

Important and Moderate Bulletins
Important fixes Nos. 1 and 2 affect every supported Windows OS and also plug holes in Windows-based programs.

Important fix No. 3 addresses Microsoft Office. Affected versions include Microsoft Office XP, as well as Microsoft Office 2003 and 2007 versions.

The fourth important bulletin is yet another Windows fix. It covers every supported OS with the exception of Vista and Windows 7. It also touches several versions of Microsoft's Exchange Server, such as Exchange Server 2000, 2003, 2007 and 2010.

The last important bulletin of the slate is another Office hotfix, covering Microsoft Office XP, Microsoft Office 2003 and Microsoft Office 2007.

Rounding out the April slate is the lone moderate bulletin, which is described as a Windows fix that affects every OS except Windows 2000 and Windows 7.

Microsoft also provides a means for IT pros to check out nonsecurity updates delivered via Windows Update and Microsoft Update. The details are described in this Knowledge Base article.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Orgs Now Getting the New Outlook for Windows

    The new Outlook for Windows 11 app is now at the "general availability" release stage for personal users, but it's also "enterprise ready."

  • Four New Microsoft Surface Devices Unveiled at Event

    Four new Surface devices for businesses were announced during Microsoft's fall hardware event.

  • Cisco To Buy Splunk for $28B

    Cisco announced it is acquiring security and IT solutions provider Splunk for about "$28 billion in equity value."

  • Copilot for Windows 11 Available September 26

    Microsoft Also announced new Copilot features coming to Bing, Edge and Microsoft 365.