Microsoft Patch Tuesday Preview, April 2013

In keeping with its usual schedule, Microsoft today released the Security Bulletin Advanced Notification for April 2013, previewing the security bulletins and associated patches it intends to release next Tuesday, April 9, 2013.  This month there are nine bulletins in all; two of these have a maximum security rating of Critical; the rest are rated Important.   Six of the bulletins, including both the Critical ones, are for Windows and its components.  All supported desktop versions of Windows have at least one Critical bulletin.  The table below shows a breakdown of the Windows bulletins by severity and Windows version.

Windows Version	Critical	Important	Moderate	Low
Windows XP+SP3	2	3	—	1
Windows Vista	2	2	1	1
Windows Server 2003	—	4	2	—
Windows Server 2008	—	3	3	—
Windows 7	2	2	—	1
Windows Server 2008 R2	—	3	2	—
Windows 8	1	2	—	1
Windows RT	1	2	—	—
Windows Server 2012	—	3	1	—
Windows Server Core	—	3	1	—

Microsoft says that five of the Windows bulletins will definitely require a restart, and the other bulletin may require one, depending on your system’s configuration.

The remaining three bulletins, all of which are rated important, app,ly to other Microsoft software products.   There will be two bulletins that affect SharePoint Server.  Groove, SharePoint Foundation, Office Web Apps, and Windows Defender for Windows 8 and RT are affected by one bulletin each.  The patch for Windows Defender will require a system reboot, and the others may require one.

As always, this information is subject to change between now and the actual release of the bulletins next Tuesday.  I will post a note here once the actual updates are available.

Microsoft Patch Tuesday, January 2013

As expected, Microsoft today released its regular monthly batch of security bulletins and associated patches.  This month there are seven bulletins, addressing 11 identified vulnerabilities.  Two bulletins have a Critical severity rating, and five are rated Important.   Six of the bulletins are for Windows and its components; every supported version of Windows is affected.  One of these bulletins also affects Microsoft Office.

The remaining bulletin is for Microsoft server software, including SharePoint, Groove, Expression Web, and System Center; this bulletin is  rated Important.  (For a breakdown of bulletin severity by Windows version, please see this month’s preview post.)  Full details, and download links, are in the Microsoft Security Bulletin Summary for January 2013.

Microsoft says that three of the Windows bulletins will definitely require a system restart; the bulletin that affects only System Center (MS13-003) will not require a restart,  The other bulletins may require one, depending on the system’s configuration.

This release does not appear to include a patch for the recently-discovered vulnerability in Internet Explorer.  I recommend following the suggested mitigation steps that Microsoft has suggested, if you hav enot already done so.

The handlers at the SANS Internet Storm Center have posted their usual summary of the patch release, along with their severity assessments.

As usual, I recommend applying these patches to your systems as soon as you conveniently can.

Microsoft Patch Tuesday Preview, January 2013

Today, in keeping with its usual schedule, Microsoft released its Security Bulletin Advanced Notification for January, previewing the security fixes it intends to release next Tuesday, January 8.   Microsoft plans to release seven security bulletins this month.  Six are for Windows and its components; two of these have a maximum severity rating of Critical, and the others are rated Important.  All  supported versions of Windows are affected.

The table below shows the breakdown of patches by Windows version and severity:

Windows Version	Critical	Important	Moderate
Windows XP+SP3	1	2	—
Windows Vista	1	4	—
Windows Server 2003	—	2	1
Windows Server 2008	—	4	1
Windows 7	2	4	—
Windows Server 2008 R2	1	4	1
Windows 8	1	4	—
Windows RT	1	3	—
Windows Server 2012	—	4	1
Windows Server Core	1	4	1

One of the bulletins (Bulletin 2 in the preview announcement) also affects Microsoft Office, and is rated Critical.  There is an additional bulletin, rated Important, which applies to Microsoft server software: SharePoint, Groove, Expression Web, and System Center.

According to Microsoft, three of the Windows bulletins will require a system restart, and the other bulletins may require one, depending on your system’s configuration.

As always, this information is subject to change between now and the actual release of the bulletins next Tuesday.  I will post a note here once the actual updates are available.

Update Thursday, 3 January, 22:00 EST

Unfortunately, it appears that none of the security bulletins that Microsoft announced addresses the recently-discovered vulnerability in Internet Explorer.   If you have not already done so, I recommend that you take some of the mitigation steps that Microsoft has suggested.

Microsoft Patch Tuesday, July 2012

It’s time for Patch Tuesday again!  In keeping with its usual schedule, Microsoft has released this month’s batch of security bulletins and patches for Windows and related software.  For July, there are nine bulletins, for 15 identified vulnerabilities.  Six of the bulletins are for Windows and its components; three of these have a maximum severity rating of Critical, and the other two are rated Important.  All  supported versions of Windows are affected.  (For a breakdown of bulletins by severity and Windows version, please see this month’s preview post.)

There are also four bulletins that affect Microsoft Office, including Office for Mac and InfoPath.  One of these is rated Critical; the rest are rated Important.   Two of the four also apply to other Microsoft software; the affected packages are SharePoint Server, Groove Server, Visual Basic for Applications, Office Web Apps, and SharePoint Services & Foundation.

Further details, and download links, are in the Security Bulletin Summary for July  2012.  Microsoft says that four of the patch installations will definitely require a system restart, and that four of the others may require one, depending on the configuration of your system.  There is one, MS12-051, which Microsoft says “does not require a restart”.  When I first read this, I was initially impressed.  I had begun to doubt that it was possible to construct a patch for Windows software that could not possibly require a re-boot; then, however, I noticed the bulletin title, “Vulnerability in Microsoft Office for Mac”.  Ah, well …

As always, I recommend that you update your systems as soon as you conveniently can.

Update Tuesday, 10 July, 0:05 EST

The Internet Storm Center at the SANS Institute has published its usual review bulletin on this month’s Microsoft patches.

Microsoft Patch Tuesday Preview, July 2012

Today, in keeping with its usual schedule, Microsoft released its Security Bulletin Advanced Notification for July, previewing the security fixes it intends to release next Tuesday, July 10.   Microsoft plans to release nine security bulletins this month.  Six are for Windows and its components; three of these have a maximum severity rating of Critical, and the other three are rated Important.  All  supported versions of Windows are affected.   The table below shows the breakdown of patches by Windows version and severity:

Windows Version	Critical	Important	Moderate
Windows XP+SP3	2	3	—
Windows Vista	3	3	—
Windows Server 2003	1	3	1
Windows Server 2008	1	3	2
Windows 7	3	3	—
Windows Server 2008 R2	1	3	2
Windows Server Core	—	3	—

There are also three bulletins that affect Microsoft Office, including Office for Mac and InfoPath.  All of these are rated Important.   Two of the three also apply to other Microsoft software; the affected packages are SharePoint Server, Groove Server, Visual Basic for Applications, Office Web Apps, and SharePoint Services & Foundation.

According to Microsoft, four of the Windows bulletins will require a system restart, and the other bulletins may require one, depending on your system’s configuration.  Two of the Office bulletins may require a restart, depending again on the system’s configuration.

As always, this information is subject to change between now and the actual release of the bulletins next Tuesday.  I will post a note here once the actual updates are available.