Microsoft: October Patch Tuesday vulnerability patched in November

Summary: [Correction: ] One of the October Internet Explorer vulnerabilities wasn't patched until November

[CORRECTION: My first take on this was just plain wrong. The update I read in the security bulletin was in the October Patch Tuesday bulletin, not the November bulletin. I was partly confused because it's unusual for Microsoft to have Cumulative Updates for Internet Explorer two months in a row, as they did in October and November. My apologies to you and to Microsoft, but what happened is still interesting, so here goes:]

Two days after the October Patch Tuesday updates, Microsoft corrected one of the security bulletins for that month to indicate that they had not in fact patched one of the vulnerabilities listed in it. That vulnerability — CVE-2013-3871 — was, in fact, patched in the November updates, specifically as part of MS13-088: Cumulative Security Update for Internet Explorer.

The initial bulletin was MS13-080: Cumulative Security Update for Internet Explorer — note that both are Cumulative Updates. It originally listed 10 vulnerabilities, one of them CVE-2013-3871. The vulnerability was credited to Simon Zuckerbraun working with HP's Zero Day Initiative.

Microsoft gave essentially no description of the vulnerability, either in October or November, beyond the title: Internet Explorer Memory Corruption Vulnerability.

Symantec has a little more explanation in their description of the bug, although this text is also boilerplate for such a vulnerability:

Microsoft Internet Explorer is prone to a memory-corruption vulnerability. Attackers can exploit this issue to execute arbitrary code in the context of the currently logged-in user. Failed attacks will cause denial-of-service conditions. Microsoft Internet Explorer 6, 7, 8, 9, and 10 are affected.

Topics: Security, Windows

Larry Seltzer has long been a recognized expert in technology, with a focus on mobile technology and security in recent years

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Microsoft to issue 8 updates, 3 critical, on Patch Tuesday

Summary: All supported versions of Microsoft Windows, Office and Internet Explorer are affected by at least one of the eight bulletins. Microsoft also clarified the impact of this week's disclosure of another vulnerability in Windows, Office and Lync.

This coming Tuesday, November 12, Microsoft will release eight updates for Microsoft Windows, Office and Internet Explorer to patch an as-yet unspecified number of vulnerabilities in them. Three of the updates, affecting Windows and Internet Explorer, are rated critical.

All supported versions of Windows, including the recently-released 8.1, are affected by at least one critical vulnerability. The one bulletin that affects Internet Explorer fixed a critical vulnerability in all versions of the browser, includng the brand new Internet Explorer 11. Three other Windows bulletins are rated Important.

Two other bulletins, both rated important, affect all supported versions of Microsoft Office.

Microsoft will also release their other usual monthly updates, including a new version of the Malicious Software Removal Tool and a large number of non-security updates.

Earlier this week Microsoft disclosed a vulnerability affecting some versions of Windows and Office and all versions of Microsoft Lync. The vulnerability is being used in zero-day attacks specifically against Office. The Patch Tuesday updates this month will not address this vulnerability.

Today Microsoft issued a clarification of the bulletin for that vulnerability. The main point of the clarification is that only some Office users are being attacked, not users of the other products who are not running an affected version of Office. The confusing nature of the product matrix comes from the confusing way in which GDI+, the affected component, is bundled with different products. If you are concerned about the vulnerability see the Microsoft bulletin for instructions on how to work around it until an update is ready from Microsoft.

Topics: Security, Microsoft, Windows

Larry Seltzer has long been a recognized expert in technology, with a focus on mobile technology and security in recent years

Kick off your day with ZDNet's daily email newsletter. It's the freshest tech news and opinion, served hot. Get it.

Wish you could predict the future? Today's data analytics is about as close as you can get to real magic. This live, interactive webcast will focus on how data analytics can help you anticipate activity to meet your ever-changing supply chain requirements. Register now!

Air Canada wanted something to make things a little easier for their customers, and using technology from IBM was able to offer self service. Check out this white paper to hear more about how IBM is making the airlines smarter.

Don't let any important alerts be missed! SolarWinds Alert Central gives you a centralized place to receive and send alerts for ALL your IT monitoring systems. Download it today!

Microsoft: A minor bug corrected in Patch Tuesday

Overview: Microsoft has updated one of its security bulletins with the news that one of the vulnerabilities listed on it actually was not patched.

Microsoft update today one of security bulletins released on Tuesday. Ms13 does-080, a cumulative update for Internet Explorer, formerly listed 10 vulnerabilities and now only nine lists.

The vulnerability is CVE-2013-3871 and was described in the original newsletter as a memory corruption vulnerability, with this making vague:

Remote code execution vulnerability exists when Internet Explorer is improperly accessing an object in memory. These vulnerabilities could corrupt memory in a way that an attacker could execute arbitrary code in the context of the current user.

The other none vulnerabilities are also memory corruption vulnerabilities.

A notice sent to a mailing list of Microsoft said that including the vulnerability in the bulletin was a mistake, and that, in fact, it was not included in the ms13 does-080 upgrade code. "CVE-2013-3871 is scheduled to be addressed in a future security update".

The original version (thanks Wayback Machine) also gives credit to Simon Zuckerbraun, working with Zero Day Initiative of HP, for reporting the vulnerability of Microsoft.

Larry Seltzer has been a recognized expert in technology, with emphasis on mobile technology and security in recent years