Skip to Content

Microsoft issues 9 security patches, including 6 ‘critical’; many plug Web holes

SEATTLE (AP) – Microsoft Corp. issued fixes for nine security flaws, including four meant to keep hackers from breaking into computers through Web pages, during a regularly scheduled update Tuesday.

Microsoft gave the four Web browsing-related patches its most severe ”critical” rating. The updates affect many versions of Windows, Server and Office software – including Windows XP and Windows Vista – and are meant to prevent hackers from breaking into Web surfers’ computers using specially crafted Web pages.

The other two critical updates target holes in the Excel spreadsheet program and in technology that lets users see downloaded images from e-mails or social networking Web sites.

Microsoft assigned the second-highest ”important” rating to three security updates.

Although the software maker has said Windows Vista, which became available to consumers in January, is its most secure operating system ever, one of the important patches Tuesday fixes a hole in ”gadgets” – small software applications – that deliver Really Simple Syndication, or RSS, feeds to the desktop.

Users who subscribe to a malicious RSS feed, add a malicious contact file or click on a malicious weather link could open the door for an attacker to run code on their systems, according to Microsoft’s security bulletin.

The other important patches plug holes in Windows Media Player and in programs that let users run more than one ”virtual” computer from inside a single hardware setup.

Amol Sarwate, manager of the vulnerability research lab run by security company Qualys Inc., said hackers are increasingly looking to the Web for ways to attack regular users’ computers.

”What we have today is the new frontier of Web-based attacks with image files, media player skins, gadgets” and other entry points, Sarwate said.

Sarwate said information technology staff at big companies have grown more savvy about security measures when running server applications. So instead, Sarwate said, attackers are looking to capitalize on average computer users’ ignorance about security to break in and install programs that can steal passwords and credit card numbers.

Windows users can visit Microsoft’s security Web site to get the updates, or configure their computers to automatically update each month.

——

On the Net:

http://www.microsoft.com/security

Keep Reading

Most Popular

The Steiner tree problem:  Connect a set of points with line segments of minimum total length.
The Steiner tree problem:  Connect a set of points with line segments of minimum total length.

The 50-year-old problem that eludes theoretical computer science

A solution to P vs NP could unlock countless computational problems—or keep them forever out of reach.

section of Rima Sharp captured by the LRO
section of Rima Sharp captured by the LRO

The moon didn’t die as early as we thought

Samples from China’s lunar lander could change everything we know about the moon’s volcanic record.

conceptual illustration of a heart with an arrow going in on one side and a cursor coming out on the other
conceptual illustration of a heart with an arrow going in on one side and a cursor coming out on the other

Forget dating apps: Here’s how the net’s newest matchmakers help you find love

Fed up with apps, people looking for romance are finding inspiration on Twitter, TikTok—and even email newsletters.

ASML machine
ASML machine

Inside the machine that saved Moore’s Law

The Dutch firm ASML spent $9 billion and 17 years developing a way to keep making denser computer chips.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.