Three critical flaws mark July Patch Tuesday

.NET, Active Directory and Excel flaws patched up

11 Reg comments Got Tips?

Microsoft's latest Patch Tuesday update brought six patches, three of which Redmond described as critical fixes.

The critical update covers flaws in Excel, Windows Active Directory, and .NET Framework. All create a possible means for hackers to inject hostile code onto vulnerable systems (remote code execution). Separate security bugs in Internet Information Server (Microsoft's web server software) and Microsoft Office Publisher also carry the same risk but earn a lower classification of "important" from Redmond. Microsoft's security gnomes have also addressed a "moderate" security bug in Windows firewall that creates an information disclosure risk.

Microsoft summary can be found here. The SANS Institute's take on "Black Tuesday" can be found here. It reckons that the IIS, Office Publisher and Windows firewall bug flaws merit a higher security classification than assigned to them by Redmond, depending on a user's systems.

None of the flaws patched on Tuesday are the subject of active hacker exploits but security researchers highlight the .NET Framework flaw as potentially the most troublesome.

"The patch for the .NET Framework is the most important patch this month. It has the potential to affect every application running on every operating system that Microsoft is actively supporting today," said Alan Bentley, md of patching and vulnerability assessment firm PatchLink. The Excel vulnerability, since it lends itself to the creation of malware targeting unpatched vulnerabilities, is also a serious concern. he added. ®

SUBSCRIBE TO OUR WEEKLY TECH NEWSLETTER


Keep Reading

We've come to wish you an unhappy birthday: Microsoft to yank services from Internet Explorer, kill off Legacy Edge by 2021

You need to give that plate back to us after you've finished your cake. Yes the fork too. We'll get your coat

Azure DevOps Services reminds users that, yes, it really is time to pull the plug on Internet Explorer 11

Ignite Sure, it's still wedged in the OS, but maybe you'd prefer something shiny and Chromier?

Microsoft teases Azure Data Explorer connector for picking its Synapse analytics service's brains

What do you mean you're not on board the Big Data bus?

In a world where up is down, it's heartwarming to know Internet Explorer still tops list of web dev pain points

Incompatibilities and inconsistent standards support among browsers ensure an ongoing source of headaches

Disabled by default: Microsoft ups the ante in its war against VBScript on Internet Explorer

Will the last IE 11 user please turn out the lights?

If you never thought you'd hear a Microsoftie tell you to stop using Internet Explorer, lap it up: 'I beg you, let it retire to great bitbucket in the sky'

We say take off and nuke the entire codebase from orbit. It's the only way to be sure

Microsoft and chums use US trademark law to trash Trickbot malware network

Multinational operation is part of election protection effort

Microsoft Defender casts a jaundiced eye over Citrix, slams services in quarantine on suspicion of being malware

You say broker, I say trojan, let's call the whole thing off

Biting the hand that feeds IT © 1998–2020