Microsoft Patch Tuesday 2008-12-09

MS80-70
Title Multiple vulnerabilities in activeX controls from visual basic 6.0's runtime allow random code execution. Also affects Visual studio, Foxpro, Frontpage, and MS Project. The vulnerable files are distributed with 3rd party applications as well.
Replaces
Affected Visual Basic Active X
KB KB932349
Known Exploits Yes
Microsoft Rating Critical
ISC Client Rating Patch now
ISC Server Rating Patch now
CVE Exploitability
2008-3704 Unknown
2008-4252 Unknown
2008-4253 Unknown
2008-4254 Unknown
2008-4255 Unknown
2008-4256 Unknown
Top of page
MS80-71
Title Multiple overflow vulnerabilities allow code execution with the rights of the logged on user via crafted WMF files.
Replaces MS80-21
Affected GDI
KB KB956802
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2008-2249 Unknown
2008-3465 Unknown
Top of page
MS80-72
Title A multitude of vulnerabilities allow random code execution in office (and via extension Outlook). Also affects the mac versions of office (Office 2004 and Office 2008).
Replaces MS80-26, MS80-42, MS80-52, MS80-57
Affected Word
KB KB957173
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2008-4024 Unknown
2008-4025 Unknown
2008-4026 Unknown
2008-4027 Unknown
2008-4028 Unknown
2008-4030 Unknown
2008-4031 Unknown
2008-4837 Unknown
Top of page
MS80-73
Title Multiple vulnerabilities allow random code execution with the rights of the logged on user.
Replaces MS80-58
Affected MSIE
KB KB958215
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2008-4258 Unknown
2008-4259 Unknown
2008-4260 Unknown
2008-4261 Unknown
Top of page
MS80-74
Title Multiple vulnerabilities allo allow random code execution in office. Also affects the mac versions of office (Office 2004 and Office 2008).
Replaces MS80-58
Affected Excel
KB KB959070
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2008-4264 Unknown
2008-4265 Unknown
2008-4266 Unknown
Top of page
MS80-75
Title Multiple vulnerabilities allow random code execution with the rights of the logged on user.
Replaces MS80-38
Affected Windows explorer
KB KB959349
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2008-4268 Unknown
2008-4269 Unknown
Top of page
MS80-76
Title Multiple vulnerabilities allow random code execution with the rights of the logged-on user.
Replaces
Affected WMC (media player)
KB KB959807
Known Exploits No
Microsoft Rating Important
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2008-3009 Unknown
2008-3010 Unknown
Top of page
MS80-77
Title Bypassing authentication is possible on sharepoint servers.
Replaces MS70-59
Affected Sharepoint
KB KB957175
Known Exploits No
Microsoft Rating Important
ISC Client Rating N/A
ISC Server Rating N/A
CVE Exploitability
2008-4032 Unknown
Top of page
We will update issues on this page for about a week or so as they evolve. We appreciate your updates!
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.