Earlier this week, Microsoft released its longest list of security bulletins yet this year. These bulletins cover patches for several preexisting security flaws in various Microsoft products. Five of the eight vulnerabilities are rated as critical, two as important, and one as moderate.
I spoke with Eric Schultze, CTO of Shavlik Technologies, about the latest patches. He finds it heartening that Microsoft has now revisited security issues that the company previously thought were too difficult to address, noting that Windows 7 developers were pulled off their projects to help develop these patches.
Following is a list of the April security bulletins. Eric recommends that end users install patches MS09-009, 010, 014, and 011, in that order, to address the Excel, WordPad, Internet Explorer, and DirectX vulnerabilities. He also urges systems administrators who administer web farms to install patch MS09-012 sooner rather than later.
- MS09-009: Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (rated critical)
- MS09-010: Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (rated critical)
- MS09-011: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (rated critical)
- MS09-012: Vulnerabilities in Windows Could Allow Elevation of Privilege (rated important)
- MS09-013: Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (rated critical)
- MS09-014: Cumulative Security Update for Internet Explorer (rated critical)
- MS09-015: Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege (rated moderate)
- MS09-016: Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service (rated important)
For more information about these security patches, go to the Microsoft Security Bulletin Summary for April 2009 page.
