Patch Tuesday heads-up:17 bulletins, 64 vulnerabilities

[Borg 386]

Microsoft is planning a monster Patch Tuesday next week: 17 bulletins with fixes for 64 documented vulnerabilities across Microsoft Windows, Microsoft Office, Internet Explorer, Visual Studio, .NET Framework and GDI+.

According to Microsoft’s advance notice, 9 of the 17 bulletins will be rated “critical,” the company’s highest severity rating.

This month’s batch of patches, due at 1:00 pm Eastern on Tuesday April 12, will include an Internet Explorer browser update that fixes a pair of publicly known security problems:

This month we’ll be closing some issues that Microsoft has already previously spoken to, including the SMB Browser (Critical) issue publicly disclosed Feb. 15. Microsoft assessed the situation and reported that although the vulnerability could theoretically allow Remote Code Execution, that was extremely unlikely. To this day, we have seen no evidence of attacks.

We are also planning a fix for the MHTML vulnerability in Windows, rated Important. We alerted people to this issue with Security Advisory 2501696 (including a Fix-It that fully protected customers once downloaded) back in late January. In March, we updated the advisory to let people know we were aware of limited, targeted attacks.

There is no word on whether this IE update will include a fix for the multiple bugs used in the winning CanSecWest Pwn2Own exploit.

All versions of Windows are affected by this batch of updates, including the newest Windows 7.

Article:

Patch Tuesday heads-up: 17 bulletins, 64 vulnerabilities | ZDNet

 

[Airbot]

16 updates for me.

 

[pparks1]

Argghh....just ran WSUS and synchronized and I have 99 updates to review for the company this morning. Jeez it takes me like a solid week to get through all of these updates and then I have to do it all again 3 weeks later.

 

[NICK ADSL UK]

Microsoft Security Bulletin Summary for April 12 2011
Microsoft Security Bulletin Summary for April 12 2011
Published: April 12 2011
Note: There may be latency issues due to replication, if the page does not display keep refreshing

Note: Security Center - Bulletins Advisories Tools Guidance Resources and Microsoft Safety & Security Center are authoritative in all matters concerning Microsoft Security Bulletins! ANY e-mail, web board or newsgroup posting (including this one) should be verified by visiting these sites for official information. Microsoft never sends security or other updates as attachments. These updates must be downloaded from the Microsoft.com download center or Windows Update. See the individual bulletins for details.
Because some malicious messages attempt to masquerade as official Microsoft security notices, it is recommended that you physically type the URLs into your web browser and not click on the hyperlinks provided.

Today Microsoft released the following Security Bulletin(s).

Bulletin Summary:
Microsoft Security Bulletin Summary for April 2011
Critical (9)
Microsoft Security Bulletin MS11-018
Cumulative Security Update for Internet Explorer (2497640)
Microsoft Security Bulletin MS11-018 - Critical: Cumulative Security Update for Internet Explorer (2497640)
Microsoft Security Bulletin MS11-019
Vulnerabilities in SMB Client Could Allow Remote Code Execution (2511455)
Microsoft Security Bulletin MS11-019 - Critical: Vulnerabilities in SMB Client Could Allow Remote Code Execution (2511455)
Microsoft Security Bulletin MS11-020
Vulnerability in SMB Server Could Allow Remote Code Execution (2508429)
Microsoft Security Bulletin MS11-020 - Critical: Vulnerability in SMB Server Could Allow Remote Code Execution (2508429)
Microsoft Security Bulletin MS11-027
Cumulative Security Update of ActiveX Kill Bits (2508272)
Microsoft Security Bulletin MS11-027 - Critical: Cumulative Security Update of ActiveX Kill Bits (2508272)
Microsoft Security Bulletin MS11-028
Vulnerability in .NET Framework Could Allow Remote Code Execution (2484015)
Microsoft Security Bulletin MS11-028 - Critical: Vulnerability in .NET Framework Could Allow Remote Code Execution (2484015)
Microsoft Security Bulletin MS11-029
Vulnerability in GDI+ Could Allow Remote Code Execution (2489979)
Microsoft Security Bulletin MS11-029 - Critical: Vulnerability in GDI+ Could Allow Remote Code Execution (2489979)
Microsoft Security Bulletin MS11-030
Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
Microsoft Security Bulletin MS11-030 - Critical: Vulnerability in DNS Resolution Could Allow Remote Code Execution (2509553)
Microsoft Security Bulletin MS11-031
Vulnerability in JScript and VBScript Scripting Engines Could Allow Remote Code Execution (2514666)
Microsoft Security Bulletin MS11-031 - Critical: Vulnerability in JScript and VBScript Scripting Engines Could Allow Remote Code Execution (2514666)
Microsoft Security Bulletin MS11-032
Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Remote Code Execution (2507618)
Microsoft Security Bulletin MS11-032 - Critical: Vulnerability in the OpenType Compact Font Format (CFF) Driver Could Allow Remote Code Execution (2507618)
Important (8)
Microsoft Security Bulletin MS11-021
Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279)
Microsoft Security Bulletin MS11-021 - Important: Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (2489279)
Microsoft Security Bulletin MS11-022
Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2489283)
Microsoft Security Bulletin MS11-022 - Important: Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2489283)
Microsoft Security Bulletin MS11-023
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293)
Microsoft Security Bulletin MS11-023 - Important: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2489293)
Microsoft Security Bulletin MS11-024
Vulnerability in Windows Fax Cover Page Editor Could Allow Remote Code Execution (2527308)
Microsoft Security Bulletin MS11-024 - Important: Vulnerability in Windows Fax Cover Page Editor Could Allow Remote Code Execution (2527308)
Microsoft Security Bulletin MS11-025
Vulnerability in Microsoft Foundation Class (MFC) Library Could Allow Remote Code Execution (2500212)
Microsoft Security Bulletin MS11-025 - Important: Vulnerability in Microsoft Foundation Class (MFC) Library Could Allow Remote Code Execution (2500212)
Microsoft Security Bulletin MS11-026
Vulnerability in MHTML Could Allow Information Disclosure (2503658)
Microsoft Security Bulletin MS11-026 - Important: Vulnerability in MHTML Could Allow Information Disclosure (2503658)
Microsoft Security Bulletin MS11-033
Vulnerability in WordPad Text Converters Could Allow Remote Code Execution (2485663)
Microsoft Security Bulletin MS11-033 - Important: Vulnerability in WordPad Text Converters Could Allow Remote Code Execution (2485663)
Microsoft Security Bulletin MS11-034
Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2506223)
Microsoft Security Bulletin MS11-034 - Important: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2506223)





Please note that Microsoft may release bulletins out side of this schedule if we determine the need to do so.
If you have any questions regarding the patch or its implementation after reading the above listed bulletin you should contact Product Support Services in the United States at 1-866-PCSafety 1-866-727-2338. International customers should contact their local subsidiary.
As always, download the updates only from the vendors website - visit Windows Update and Office Update or Microsoft Update websites. You may also get the updates thru Automatic Updates functionality in Windows system.
Security Tool
Find out if you are missing important Microsoft product updates by using MBSA.

 

[Buddahfan]

All 17 updates downloaded and installed without any noticeable problems

 

[sygnus21]

21 here, plus two unchecked :shock:

This includes 3 C++ updates - 2005, 2008, 2010

 

[ignatzatsonic]

Hmmmm.................it offered me nothing at all.

 

[Fayla]

13, unlucky for some.

 

[fimble]

Hmmmm.................it offered me nothing at all.

This usually means you have been chosen for the "V.I.P. special client service". Batten down the hatches! Prepare to be bombarded!

 

[sygnus21]

Hmmmm.................it offered me nothing at all.

Yeah I don't know how you didn't get offered anyting. That is kind of weird

Anyway I just installed 23 updates.

 

[ignatzatsonic]

Hmmmm.................it offered me nothing at all.

Yeah I don't know how you didn't get offered anyting. That is kind of weird

Anyway I just installed 23 updates.

I wonder if it is because I just installed my replacement motherboard due to the well-known Intel chipset recall?

 

[NICK ADSL UK]

Hmmmm.................it offered me nothing at all.

the download is dependent on where you live as not all countries get the updates at the same time.

 

[sygnus21]

Hmmmm.................it offered me nothing at all.

Yeah I don't know how you didn't get offered anyting. That is kind of weird

Anyway I just installed 23 updates.

I wonder if it is because I just installed my replacement motherboard due to the well-known Intel chipset recall?

That really shouldn't have anything to do with it. The board is hardware, the OS is software. If Windows isn't offering any updates you may have an issue.

Also another possibility is that the OS needs to be reactivated since you replaced the MB. That tends to happen a lot. Check that that's not the issue.

Let us know.

the download is dependent on where you live as not all countries get the updates at the same time.

This is also true.... where are you??? US?

 

[ignatzatsonic]

Well, I'm in the Western USA if it matters.

I am activated. Actually, I had to re-activate by phone when I put the new board in. I just rechecked and it says "activation was successful" (referring to my reactivation of a couple of days ago).

 

[sygnus21]

Don't know what's going on then as the US has these updates - I'm on the east coast, and I believe Airbot is on the west cost and we both got the update.

Have you checked the "view update history" link? Maybe you were updated and didn't realize it.

 

[ignatzatsonic]

Don't know what's going on then as the US has these updates - I'm on the east coast, and I believe Airbot is on the west cost and we both got the update.

Have you checked the "view update history" link? Maybe you were updated and didn't realize it.

View attachment 148758

I just checked update history.

My last update of ANY kind was yesterday, the 11th, and that was virus definitions.

My last update excluding virus definitions was March 23.

I'm only mildly concerned about this unless it persists for days and weeks.

 

[NICK ADSL UK]

you should only be concerned if you have not received the updates after 24 hours

 

[ignatzatsonic]

Ok, thanks Nick. I'll keep an eye on it.

 

[indianacarnie]

It only offered me 2 updates when I checked about 3 hours ago. Installed them then went surfing,when I read this thread I went back and "doublechecked" and there were 22 more. Am installing them as we speak.

 

[flashh4]

Hope this is the right thread to post this.
I have one update that just will not install, i have turned off firewall & antivirus. It still will not install !

Security Update for Microsoft .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows 7, Windows Server 2008, Windows Server 2008 R2 for x64-based Systems (KB2446708)

Download size: 23.3 MB

You may need to restart your computer for this update to take effect.

kb2446708
Microsoft has released security bulletin MS11-028

Update type: Important

A security issue has been identified that could allow an attacker to compromise your Windows-based system that is running the Microsoft .NET Framework and gain complete control over it. You can help protect your computer by installing this update from Microsoft. After you install this item, you may have to restart your computer.

More information:
MS11-028: Description of the security update for the .NET Framework 4 on Windows XP, Windows Server 2003, Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: April 12, 2011

Help and Support:
Microsoft Support


Nothing seems to help !

Thanks
Chuck
Windows7 on a HP computer specs excellent !