Big Security Patch Expected on Tuesday

Expect a whopper patch next week, as Microsoft is planning to release 11 fixes in its April security update.

The April patch may contain five "critical" fixes, plus five "important" ones, as well as one "moderate" fix. As usual, remote code execution (RCE) exploit considerations dominate the slate. Eight of the patches deal with RCE risks, while spoofing, elevation-of-privilege and denial-of-service vulnerabilities are among the other system stressors.

Tuesday's patch will address 25 vulnerabilities in Windows, Microsoft Office and Microsoft Exchange, according to Microsoft Security Response Center spokesman Jerry Bryant.

Bryant also said that a vulnerability in VBScript that could allow RCE attacks and a denial-of-service hole in Redmond's Server Message Block (SMB) Windows component would both be addressed with next week's patch.

The Internet Explorer flaw exploited at this year's Pwn2Own contest will not be patched this month. It's likely that there won't be another IE patch until May and beyond. Microsoft had issued a cumulative out-of-band patch for Internet Explorer just last week.

Critical Bulletins
All of the critical bulletins are Windows operating system fixes with RCE considerations.

The first two critical fixes affect every supported version of Windows operating systems, including Windows 7. Meanwhile, critical fix No. 3 only touches Windows 2000 Server Service.

The fourth critical hotfix affects every OS except Windows 7 and Windows Server 2008. The fifth and final critical security bulletin covers Windows 2000 and Windows XP.

Important and Moderate Bulletins
Important fixes Nos. 1 and 2 affect every supported Windows OS and also plug holes in Windows-based programs.

Important fix No. 3 addresses Microsoft Office. Affected versions include Microsoft Office XP, as well as Microsoft Office 2003 and 2007 versions.

The fourth important bulletin is yet another Windows fix. It covers every supported OS with the exception of Vista and Windows 7. It also touches several versions of Microsoft's Exchange Server, such as Exchange Server 2000, 2003, 2007 and 2010.

The last important bulletin of the slate is another Office hotfix, covering Microsoft Office XP, Microsoft Office 2003 and Microsoft Office 2007.

Rounding out the April slate is the lone moderate bulletin, which is described as a Windows fix that affects every OS except Windows 2000 and Windows 7.

Microsoft also provides a means for IT pros to check out nonsecurity updates delivered via Windows Update and Microsoft Update. The details are described in this Knowledge Base article.

About the Author

Jabulani Leffall is an award-winning journalist whose work has appeared in the Financial Times of London, Investor's Business Daily, The Economist and CFO Magazine, among others.


  • Microsoft Adds Privileged Identity Management Delegation to Azure Lighthouse

    The commercial release of Privileged Identity Management (PIM)-enabled Azure Lighthouse delegations is now available, Microsoft on Monday announced.

  • Microsoft Commercially Releases Entra Workload Identities

    Microsoft announced on Monday that its Entra Workload Identities service is now available as a commercial product offering, having reached the "general availability" stage.

  • The 2022 Microsoft Product Roadmap

    Microsoft has a lot in the docket for 2022, including new products like SQL Server 2022, Exchange Subscription Edition and Visual Studio 2022 for Mac.

  • OpenSSF Adopts Microsoft Open Source Software Security Guidelines

    The Open Source Security Foundation (OpenSSF) announced on Wednesday that it has adopted the Secure Supply Chain Consumption Framework (S2C2F) for ensuring the secure use of open source software (OSS) by developers.