Microsoft has a small Patch Tuesday planned for this month. The company said it will ship two security bulletins on 11 May to fix vulnerabilities in Windows, Office and Visual Basic for Applications. Both bulletins are rated critical and cover vulnerabilities that leave users open to remote code execution by attackers.
“Windows 7 and Windows Server 2008 R2 customers will be offered the Windows-related update but they are not vulnerable in their default configurations,” noted Jerry Bryant, group manager of Response Communications for Microsoft Security Response Center.
Missing from the lineup is a patch for a cross-site scripting flaw affecting Office SharePoint 2007 and Windows SharePoint Services 3.0 that was reported the week of April 26. Bryant said the company is still working on an update to address the issue, and recommended that users try the workaround contained in the advisory issued April 29.
The SharePoint vulnerability permits escalation of privileges within the SharePoint site. If an attacker successfully exploits the vulnerability, the attacker could run commands against the SharePoint server with the privileges of the compromised user.
According to Microsoft, Internet Explorer 8 users browsing to a SharePoint site in the Internet Zone are at a reduced risk because the XSS Filter in IE 8 prevents this attack by default. The XSS Filter is not enabled by default in the Intranet Zone, however.
Workforce blow. Newly privatised Toshiba has embarked on a 'revitalisation plan' that will entail the…
European Commission opens an official child safety investigation into Facebook and Instagram-owner Meta Platforms
Hundreds of AI and cloud engineers are being offered relocation out of China by Microsoft,…
Workers at unionised Apple store in Maryland vote to authorise first ever strike, after delays…
Elon Musk loses bid to avoid court order to force him to testify in SEC…
Explore how cutting-edge technologies are reshaping decision-making, driving innovation, and propelling businesses into the data-driven…