Microsoft kicks off 2012 with seven security bulletins

Stephen Withers
Wednesday, 11 January 2012 08:39

Business IT - Security

The first Patch Tuesday for 2012 brings seven bulletins from Microsoft. One was held over from December, and only one of the seven is regarded as being critical.

As foreshadowed, Microsoft's first Patch Tuesday for 2012 brings seven bulletins - one critical and six important.

The most pressing vulnerabilities are in Windows Media, and can be exploited by maliciously crafted media files. The critical issue affects all currently supported versions of Windows except Windows 7. A flaw allows DirectShow's MIDI parser to be misused to allow remote code execution.

The other vulnerability covered by that bulletin exploits DirectShow's closed caption decoder. Microsoft officials noted that closed captions are disabled by default in Windows Media Player 12.

This month's bulletins include a fix for an SSL issue that was planned for release in December 2011 but was held over to allow investigation of compatibility issues with certain non-Microsoft products.

Most of Microsoft's security bulletins cover issues that fall into the categories of remote code execution, elevation of privilege, or information disclosure. This month there's one described as a security feature bypass.

CONTINUED