May 2013 - Microsoft Releases 7 Security Advisories

Microsoft addresses the following vulnerabilities in its May batch of patches:

• (MS13-037) Cumulative Security Update for Internet Explorer (2829530)
  Risk Rating: Critical
  
  

  This patch addresses eleven vulnerabilities found in Internet Explorer, which may lead to malware execution. Users may encounter this attack when visiting specific webpage using Internet Explorer. Exploiting this vulnerability can also give attacker same access right as current user.Read more here.

• (MS13-038) Security Update for Internet Explorer (2847204)
  Risk Rating: Critical
  
  

  This patch addresses one publicly disclosed vulnerability in Internet Explorer that may lead to remote code execution. Users may encounter this by visiting compromised webpage. Read more here.

• (MS13-039) Vulnerability in HTTP.sys Could Allow Denial of Service (2829254)
  Risk Rating: Important
  
  

  This patch addresses a security flaw found in Microsoft Windows. When exploited, this could lead to denial of service (DoS) attack. Read more here.

• (MS13-040) Vulnerabilities in .NET Framework Could Allow Spoofing (2836440)
  Risk Rating: Important
  
  

  This patch addresses two vulnerabilities in the .NET framework that may lead to spoofing once a .NET application receives a malicious XML file. Once exploit is successful, attacker could modify the content of .XML file and gain endpoint functions. Read more here.

• (MS13-041) Vulnerability in Lync Could Allow Remote Code Execution (2834695)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability in Microsoft Lync that may allow an attacker to execute a malware. For attack to be successful, attacker must make a user accpet a Lync or Communicator invitation then share a malicious file or program disguised as a presentation in Lync of Communicator. Read more here.

• (MS13-042) Vulnerabilities in Microsoft Publisher Could Allow Remote Code Execution (2830397)
  Risk Rating: Important
  
  

  This patch addresses eleven vulnerabilities in Microsoft Office that could lead to users executing a malware. Users may encounter this via malware disguised as Publisher file and opening it using vulnerable Microsoft Publisher. Once done, attacker gains same user rights as the current user. Read more here.

• (MS13-043) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2830399)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability in Microsoft Office that could allow remote code execution once user opens a malware disguised as an email message. Once successful, users can gain the same access rights as current user. Read more here.

• (MS13-044) Vulnerability in Microsoft Word Could Allow Remote Code Execution (2830399)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability in Microsoft Office that may lead to unwanted information disclosure by opening a specifically crafted Visio file. Read more here.

• (MS13-045) Vulnerability in Windows Essentials Could Allow Information Disclosure (2813707)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability . Read more here.

• (MS13-046) Vulnerabilities in Kernel-Mode Drivers Could Allow Elevation Of Privilege (2840221)
  Risk Rating: Important
  
  

  This patch addresses a vulnerability in Microsoft Windows that may lead to an attacker gaining elevation of privilege. To do this, an attacker must have valid logon credentials before exploiting this vulnerability locally. Read more here.