The Microsoft Security Response Center has issued the expected advance notification on next week’s Patch Tuesday for security updates and it is a big one this time.
The April 2011 Patch Tuesday is made up of 17 bulletins of which 9 are Critical updates with the remaining 8 being Important ones. All of them fix issues concerning the Remote Execution of exploits and one is related to an elevation of privileges.
The patches impact software across the Microsoft inventory:
- Microsoft Windows
- Internet Explorer
- Microsoft Office
- Microsoft Server Software
- Microsoft Developer Tools and Software
According to the MSRC they are not only fixing some new issues but closing out some that were identified in the past:
Today, we’re providing advanced notification on the release of 17 security bulletins, nine rated Critical and eight rated Important. This month’s bulletin release will address 64 vulnerabilities across Microsoft Windows, Microsoft Office, Internet Explorer, Visual Studio, .NET Framework and GDI+.
This month we’ll be closing some issues that Microsoft has already previously spoken to, including the SMB Browser (Critical) issue publicly disclosed Feb. 15. Microsoft assessed the situation and reported that although the vulnerability could theoretically allow Remote Code Execution, that was extremely unlikely. To this day, we have seen no evidence of attacks.
We are also planning a fix for the MHTML vulnerability in Windows, rated Important. We alerted people to this issue with Security Advisory 2501696 (including a Fix-It that fully protected customers once downloaded) back in late January. In March, we updated the advisory to let people know we were aware of limited, targeted attacks.
As usual they will host a webcast for questions and answers concerning these updates following their release:
The monthly technical webcast is scheduled for Wednesday, April 13, hosted by Jerry Bryant and Jonathan Ness. I invite you to tune in and learn more about the security bulletins. The webcast is scheduled for Wednesday, April 13, 2011 at 11 a.m. PDT, and the registration can be found here.
I recommend you follow the MSRC team on Twitter at @MSFTSecResponse to keep up with them and their security related info. They never tweet about anything boring!
