Microsoft Security Bulletin MS14-016 - Important: Vulnerability in Security Account Manager Remote (SAMR) Protocol Could Allow Security Feature Bypass (2934418) - Version: 1.1

Severity Rating: CriticalRevision Note: V1.1 (May 20, 2014): Clarified in the vulnerability FAQ what systems are primarily at risk for CVE-2014-0317. Added Update FAQ to explain why users running Windows Vista, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, or Windows Server 2012 R2 might not be offered the update. These are informational changes only.Summary: This security update resolves one privately reported vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if an attacker makes multiple attempts to match passwords to a username.

Posted by on 20 May 2014 | 2:00 am

Microsoft Security Bulletin MS14-018 - Critical: Cumulative Security Update for Internet Explorer (2950467) - Version: 1.1

Severity Rating: CriticalRevision Note: V1.1 (April 17, 2014): Revised bulletin to help clarify that although Internet Explorer 10 is not affected by the vulnerabilities described in this bulletin, an update is available for Internet Explorer 10 that includes non-security updates. See the Update FAQ for details.Summary: This security update resolves six privately reported vulnerabilities in Internet Explorer. These vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Posted by on 17 April 2014 | 2:00 am

Microsoft Security Bulletin MS14-017 - Critical: Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2949660) - Version: 1.0

Severity Rating: CriticalRevision Note: V1.0 (April 8, 2014): Bulletin published.Summary: This security update resolves one publicly disclosed vulnerability and two privately reported vulnerabilities in Microsoft Office. The most severe of these vulnerabilities could allow remote code execution if a specially crafted file is opened or previewed in an affected version of Microsoft Office software. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Posted by on 8 April 2014 | 2:00 am

Microsoft Security Bulletin MS14-020 - Important: Vulnerability in Microsoft Publisher Could Allow Remote Code Execution - Important (2950145) - Version: 1.0

Severity Rating: ImportantRevision Note: V1.0 (April 8, 2014): Bulletin published.Summary: This security update resolves a privately reported vulnerability in Microsoft Office. The vulnerability could allow remote code execution if a user opens a specially crafted file in an affected version of Microsoft Publisher. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Posted by on 8 April 2014 | 2:00 am

Microsoft Security Bulletin MS14-019 - Important: Vulnerability in Windows File Handling Component Could Allow Remote Code Execution (2922229) - Version: 1.0

Severity Rating: CriticalRevision Note: V1.0 (April 8, 2014): Bulletin published.Summary: This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user runs specially crafted .bat and .cmd files from a trusted or semi-trusted network location. An attacker would have no way to force users to visit the network location or run the specially crafted files. Instead, an attacker would have to convince users to take such action. For example, an attacker could trick users into clicking a link that takes them to the location of the attacker's specially crafted files and subsequently convince them to run them.

Posted by on 8 April 2014 | 2:00 am

Microsoft Security Bulletin MS14-012 - Critical: Cumulative Security Update for Internet Explorer (2925418) - Version: 1.0

Severity Rating: CriticalRevision Note: V1.0 (March 11, 2014): Bulletin published.Summary: This security update resolves one publicly disclosed vulnerability and seventeen privately reported vulnerabilities in Internet Explorer. These vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Posted by on 11 March 2014 | 2:00 am

Microsoft Security Bulletin MS14-013 - Critical: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (2929961) - Version: 1.0

Severity Rating: CriticalRevision Note: V1.0 (March 11, 2014): Bulletin published.Summary: This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user opens a specially crafted image file. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Posted by on 11 March 2014 | 2:00 am

Microsoft Security Bulletin MS14-015 - Important: Vulnerabilities in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2930275) - Version: 1.0

Severity Rating: ImportantRevision Note: V1.0 (March 11, 2014): Bulletin published.Summary: This security update resolves one publicly disclosed vulnerability and one privately reported vulnerability in Microsoft Windows. The more severe of these vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit these vulnerabilities.

Posted by on 11 March 2014 | 2:00 am

Microsoft Security Bulletin MS14-014 - Important: Vulnerability in Silverlight Could Allow Security Feature Bypass (2932677) - Version: 1.0

Severity Rating: ImportantRevision Note: V1.0 (March 11, 2014): Bulletin published.Summary: This security update resolves a privately reported vulnerability in Microsoft Silverlight. The vulnerability could allow security feature bypass if an attacker hosts a website that contains specially crafted Silverlight content that is designed to exploit the vulnerability, and then convinces a user to view the website. In all cases, however, an attacker would have no way to force users to visit a website. Instead, an attacker would have to convince users to visit a website, typically by getting them to click a link in an email message or in an Instant Messenger message that takes them to the attacker's website. It could also be possible to display specially crafted web content by using banner advertisements or by using other methods to deliver web content to affected systems.

Posted by on 11 March 2014 | 2:00 am

Vulnerability in Windows Could Allow Remote Code Execution - Version: 1.3

Severity Rating: CriticalRevision Note: V1.3 (February 28, 2014): Bulletin revised to announce a detection change in the 2893294 update for Windows 8.1 for 32-bit Systems, Windows 8.1 for x64-based Systems, Windows RT 8.1, and Windows Server 2012 R2. This is a detection change only. There were no changes to the update files. Customers who have already successfully updated their systems do not need to take any action.Summary: This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user or application runs or installs a specially crafted, signed portable executable (PE) file on an affected system.

Posted by on 28 February 2014 | 1:00 am

Microsoft Security Bulletin MS14-005 - Important: Vulnerability in Microsoft XML Core Services Could Allow Information Disclosure (2916036) - Version: 1.1

Severity Rating: ImportantRevision Note: V1.1 (February 28, 2014): Bulletin revised to announce a detection change in the 2916036 update for Windows 8.1 for 32-bit Systems, Windows 8.1 for x64-based Systems, Windows Server 2012 R2, and Windows RT 8.1. This is a detection change only. There were no changes to the update files. Customers who have already successfully updated their systems do not need to take any action.Summary: This security update resolves a publicly disclosed vulnerability in Microsoft XML Core Services included in Microsoft Windows. The vulnerability could allow information disclosure if a user views a specially crafted webpage using Internet Explorer. An attacker would have no way to force users to view specially crafted content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to an attacker's website, or by getting them to open an attachment sent through email.

Posted by on 28 February 2014 | 1:00 am

Microsoft Security Bulletin MS14-009 - Important: Vulnerabilities in .NET Framework Could Allow Elevation of Privilege (2916607) - Version: 1.1

Severity Rating: ImportantRevision Note: V1.1 (February 28, 2014): Bulletin revised to announce a detection change in the 2901128 update for Microsoft .NET Framework 4.5.1 on Windows 8.1 for 32-bit Systems, Microsoft .NET Framework 4.5.1 on Windows 8.1 for x64-based Systems, Microsoft .NET Framework 4.5.1 on Windows Server 2012 R2, and Microsoft .NET Framework 4.5.1 on Windows RT 8.1. This is a detection change only. There were no changes to the update files. Customers who have already successfully updated their systems do not need to take any actioned.Summary: This security update resolves two publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft .NET Framework. The most severe vulnerability could allow elevation of privilege if a user visits a specially crafted website or a website containing specially crafted web content. In all cases, however, an attacker would have no way to force users to visit such websites. Instead, an attacker would have to convince users to visit the compromised website, typically by getting them to click a link in an email message or in an Instant Messenger message that takes them to the attacker's website.

Posted by on 28 February 2014 | 1:00 am

Microsoft Security Bulletin MS14-007 - Critical: Vulnerability in Direct2D Could Allow Remote Code Execution (2912390) - Version: 1.1

Severity Rating: CriticalRevision Note: V1.1 (February 28, 2014): Bulletin revised to announce a detection change in the 2912390 update for Windows 8.1 for 32-bit Systems, Windows 8.1 for x64-based Systems, Windows RT 8.1, and Windows Server 2012 R2. This is a detection change only. There were no changes to the update files. Customers who have already successfully updated their systems do not need to take any action.Summary: This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker would have no way to force users to view specially crafted content. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or in an Instant Messenger message that takes users to an attacker's website, or by getting them to open an attachment sent through email.

Posted by on 28 February 2014 | 1:00 am

Vulnerability in Digital Signatures Could Allow Denial of Service - Version: 1.1

Severity Rating: ImportantRevision Note: V1.1 (February 28, 2014): Bulletin revised to announce a detection change in the 2868626 update for Windows 8.1 for 32-bit Systems, Windows 8.1 for x64-based Systems, Windows RT 8.1, and Windows Server 2012 R2. This is a detection change only. There were no changes to the update files. Customers who have already successfully updated their systems do not need to take any action.Summary: This security update resolves a privately reported vulnerability in Microsoft Windows. The vulnerability could allow denial of service when an affected web service processes a specially crafted X.509 certificate.

Posted by on 28 February 2014 | 1:00 am

Cumulative Security Update of ActiveX Kill Bits - Version: 1.1

Severity Rating: CriticalRevision Note: V1.1 (February 28, 2014): Bulletin revised to announce a detection change in the 2900986 update for Windows 8.1 for 32-bit Systems, Windows 8.1 for x64-based Systems, Windows RT 8.1, and Windows Server 2012 R2. This is a detection change only. There were no changes to the update files. Customers who have already successfully updated their systems do not need to take any action.Summary: This security update resolves a privately reported vulnerability that is currently being exploited. The vulnerability exists in the InformationCardSigninHelper Class ActiveX control. The vulnerability could allow remote code execution if a user views a specially crafted webpage with Internet Explorer, instantiating the ActiveX control. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Posted by on 28 February 2014 | 1:00 am

Microsoft Security Bulletin MS14-008 - Critical: Vulnerability in Microsoft Forefront Protection for Exchange Could Allow Remote Code Execution (2927022) - Version: 1.0

Severity Rating: CriticalRevision Note: V1.0 (February 11, 2014): Bulletin published.Summary: This security update resolves a privately reported vulnerability in Microsoft Forefront. The vulnerability could allow remote code execution if a specially crafted email message is scanned.

Posted by on 11 February 2014 | 1:00 am

Microsoft Security Bulletin MS14-011 - Critical: Vulnerability in VBScript Scripting Engine Could Allow Remote Code Execution (2928390) - Version: 1.0

Severity Rating: CriticalRevision Note: V1.0 (February 11, 2014): Bulletin published.Summary: This security update resolves a privately reported vulnerability in the VBScript scripting engine in Microsoft Windows. The vulnerability could allow remote code execution if a user visited a specially crafted website. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to take action, typically by getting them to click a link in an email message or Instant Messenger message that takes users to the attacker's website.

Posted by on 11 February 2014 | 1:00 am

Microsoft Security Bulletin MS14-010 - Critical: Cumulative Security Update for Internet Explorer (2909921) - Version: 1.0

Severity Rating: CriticalRevision Note: V1.0 (February 11, 2014): Bulletin published.Summary: This security update resolves one publicly disclosed vulnerability and twenty-three privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited the most severe of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Posted by on 11 February 2014 | 1:00 am

Microsoft Security Bulletin MS14-006 – Important: Vulnerability in IPv6 Could Allow Denial of Service (2904659) - Version: 1.0

Severity Rating: ImportantRevision Note: V1.0 (February 11, 2014): Bulletin published Summary: This security update resolves a publicly disclosed vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an attacker sends a large number of specially crafted IPv6 packets to an affected system. To exploit the vulnerability, an attacker's system must belong to the same subnet as the target system.

Posted by on 11 February 2014 | 1:00 am

Vulnerability in HTML Sanitization Component Could Allow Elevation of Privilege - Version: 1.4

Severity Rating: ImportantRevision Note: V1.4 (January 15, 2014): Bulletin revised to announce a detection change in update 2687356 (a.k.a. 2687442). This is a detection change only. Customers who have already successfully updated their systems do not need to take any action. Note that update 2687356 is offered through Microsoft Update as update 2687442.Summary: This security update resolves a publicly disclosed vulnerability in Microsoft Office, Microsoft Communications Platforms, Microsoft Server software, and Microsoft Office Web Apps. The vulnerability could allow elevation of privilege if an attacker sends specially crafted content to a user. clicks a specially crafted URL that takes the user to a targeted SharePoint site.

Posted by on 15 January 2014 | 1:00 am

Vulnerabilities in SharePoint Could Allow Elevation of Privilege - Version: 2.2

Severity Rating: ImportantRevision Note: V2.2 (January 15, 2014): Bulletin revised to announce a detection change in update 2596911. This is a detection change only. Customers who have already successfully updated their systems do not need to take any action.Summary: This security update resolves one publicly disclosed and five privately reported vulnerabilities in Microsoft SharePoint and Windows SharePoint Services. The most severe vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes the user to a targeted SharePoint site.

Posted by on 15 January 2014 | 1:00 am

Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution - Version: 2.0

Severity Rating: CriticalRevision Note: V2.0 (January 14, 2014): Rereleased bulletin to announce the reoffering of the 2862330 update to systems running Windows 7 or Windows Server 2008 R2. See the Update FAQ for details.Summary: This security update resolves seven privately reported vulnerabilities in Microsoft Windows. The most severe of these vulnerabilities could allow remote code execution if a user views shared content that embeds OpenType or TrueType font files. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system.

Posted by on 14 January 2014 | 1:00 am

Microsoft Security Bulletin MS14-001 - Important: Vulnerabilities in Microsoft Word and Office Web Apps Could Allow Remote Code Execution (2916605) - Version: 1.0

Severity Rating: ImportantRevision Note: V1.0 (January 14, 2014): Bulletin published.Summary: This security update resolves three privately reported vulnerabilities in Microsoft Office. The vulnerabilities could allow remote code execution if a specially crafted file is opened in an affected version of Microsoft Word or other affected Microsoft Office software. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Posted by on 14 January 2014 | 1:00 am

Microsoft Security Bulletin MS14-004 - Important: Vulnerability in Microsoft Dynamics AX Could Allow Denial of Service (2880826) - Version: 1.0

Severity Rating: ImportantRevision Note: V1.0 (January 14, 2014): Bulletin published.Summary: This security update resolves one privately reported vulnerability in Microsoft Dynamics AX. The vulnerability could allow denial of service if an authenticated attacker submits specially crafted data to an affected Microsoft Dynamics AX Application Object Server (AOS) instance. An attacker who successfully exploited this vulnerability could cause the target AOS instance to stop responding to client requests.

Posted by on 14 January 2014 | 1:00 am

Microsoft Security Bulletin MS14-003 – Important: Vulnerability in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2913602) - Version: 1.0

Severity Rating: ImportantRevision Note: V1.0 (January 14, 2014): Bulletin published.Summary: This security update resolves a publicly reported vulnerability in Microsoft Windows. The vulnerability could allow elevation of privilege if an attacker logs on to a system and runs a specially crafted application. An attacker must have valid logon credentials and be able to log on locally to exploit this vulnerability.

Posted by on 14 January 2014 | 1:00 am