More Windows and Office security flaws fixed

Stephen Withers
Wednesday, 09 April 2008 02:53

Business IT - Technology

Microsoft's latest set of security updates address critical flaws in all currently supported versions of Windows. Components of the Office suite are also affected.

The critical Windows vulnerabilities fixed by this month's patches involve the maliciously crafted EMF or WMF image files or VBScripts or JScripts, an Internet Explorer bug, and new ActiveX kill bits, including one for Yahoo! Music Jukebox. All these issues had the potential to allow remote code execution.

Windows 2000, XP, Server 2003, Server 2008 and Vista are all affected.

The other critical issue fixed this month concerns Project 2000, 2002 and 2003. A maliciously crafted Project file could allow the execution of arbitrary code.

Less significant updates (all rated 'important') address DNS spoofing and privilege escalation issues in Windows (excluding Server 2008), and a remote code execution problem in Visio 2002, 2003 and 2007.

Alongside the security related patches, Microsoft also released Service Pack 1 for the US and UK versions of Office Accounting 2008, and updates for Microsoft Office Genuine Advantage Notifications, the Outlook 2003 and 2007 junk email filters, Office 2007 (to fix an issue that could arise when installing SP1), and Windows Live Writer.