Big Security Patch Expected on Tuesday

Expect a whopper patch next week, as Microsoft is planning to release 11 fixes in its April security update.

The April patch may contain five "critical" fixes, plus five "important" ones, as well as one "moderate" fix. As usual, remote code execution (RCE) exploit considerations dominate the slate. Eight of the patches deal with RCE risks, while spoofing, elevation-of-privilege and denial-of-service vulnerabilities are among the other system stressors.

Tuesday's patch will address 25 vulnerabilities in Windows, Microsoft Office and Microsoft Exchange, according to Microsoft Security Response Center spokesman Jerry Bryant.

Bryant also said that a vulnerability in VBScript that could allow RCE attacks and a denial-of-service hole in Redmond's Server Message Block (SMB) Windows component would both be addressed with next week's patch.

The Internet Explorer flaw exploited at this year's Pwn2Own contest will not be patched this month. It's likely that there won't be another IE patch until May and beyond. Microsoft had issued a cumulative out-of-band patch for Internet Explorer just last week.

Critical Bulletins
All of the critical bulletins are Windows operating system fixes with RCE considerations.

The first two critical fixes affect every supported version of Windows operating systems, including Windows 7. Meanwhile, critical fix No. 3 only touches Windows 2000 Server Service.

The fourth critical hotfix affects every OS except Windows 7 and Windows Server 2008. The fifth and final critical security bulletin covers Windows 2000 and Windows XP.

Important and Moderate Bulletins
Important fixes Nos. 1 and 2 affect every supported Windows OS and also plug holes in Windows-based programs.

Important fix No. 3 addresses Microsoft Office. Affected versions include Microsoft Office XP, as well as Microsoft Office 2003 and 2007 versions.

The fourth important bulletin is yet another Windows fix. It covers every supported OS with the exception of Vista and Windows 7. It also touches several versions of Microsoft's Exchange Server, such as Exchange Server 2000, 2003, 2007 and 2010.

The last important bulletin of the slate is another Office hotfix, covering Microsoft Office XP, Microsoft Office 2003 and Microsoft Office 2007.

Rounding out the April slate is the lone moderate bulletin, which is described as a Windows fix that affects every OS except Windows 2000 and Windows 7.

Microsoft also provides a means for IT pros to check out nonsecurity updates delivered via Windows Update and Microsoft Update. The details are described in this Knowledge Base article.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Azure AD Outage Linked to Multifactor Authentication Issues

    An Azure Active Directory outage that lasted for about 2.5 hours was caused by multifactor authentication challenges not working, according to Microsoft.

  • The 2019 Microsoft Product Roadmap

    From the next major update to Windows 10 to the next generation of HoloLens, here's what's on tap from Microsoft this year.

  • 2019 Microsoft Conference Calendar: For Partners, IT Pros and Developers

    Here's your guide to all the IT training sessions, partner meet-ups and annual Microsoft conferences you won't want to miss this year.

  • Microsoft Launches Desktop Analytics Service for Windows Devices

    Now generally available, Desktop Analytics gives organizations dashboard views of their managed Windows "endpoints, applications and drivers."

RCP Update

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.