Microsoft Patch Tuesday 2009-06-09

MS90-18
Title A vulnerability in freeing memory on Windows 2000 server leads to remote code execution and another one leads to DoS on active directory on Windows 2000 and 2003 server as well as ADAM installation on XP and server 2003.
Replaces MS80-35, MS80-60
Affected Active Directory
KB KB971055
Known Exploits No
Microsoft Rating Critical
ISC Client Rating N/A
ISC Server Rating N/A
CVE Exploitability
2009-1138 1
2009-1139 3
Top of page
MS90-19
Title A cumulative patch for IE. The worst of them leads to random code execution. Affects IE5.01 up to and including IE8.
Replaces MS80-14
Affected Internet Explorer
KB KB969897
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2009-1140 3
2009-1141 3
2009-1529 1
2009-1530 3
2009-1531 2
2009-1532 2
2007-3091 3
Top of page
MS90-20
Title Input validation errors in the WebDAV extentions for IIS allow privilege escalation.
Replaces
Affected Webdav IIS ()
KB KB970483
Known Exploits No
Microsoft Rating Important
ISC Client Rating N/A
ISC Server Rating N/A
CVE Exploitability
2009-1122 3
2009-1535 1
Top of page
MS90-21
Title A number of vulnerabilities allow random code execution. Updates for Office for Mac versions are bundled with the fixes for MS09-017 and MS09-027.
Replaces MS80-57, MS80-74, MS90-09
Affected Excel
KB KB969462
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2009-0549 2
2009-0557 1
2009-0558 2
2009-0559 1
2009-0560 3
2009-0561 1
2009-1134 1
Top of page
MS90-22
Title Vulnerabilities in th eprint spooler allow random code execution, Information leaks and Privilege escalation.
Replaces MS70-21
Affected print spooler
KB KB961501
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Important
ISC Server Rating Important
CVE Exploitability
2009-0228 1
2009-0229 3
2009-0230 1
Top of page
MS90-23
Title A vulnerability in generating file previews allows HTML scripting to run on affected clients.
Replaces
Affected Windows Search
KB KB963093
Known Exploits No
Microsoft Rating Moderate
ISC Client Rating Important
ISC Server Rating Important
CVE Exploitability
2009-0239 3
Top of page
MS90-24
Title A buffer overflow vulnerability allows code execution on affected systems.
Replaces MS80-72
Affected Works convertors
KB KB957632
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2009-1533 1
Top of page
MS90-25
Title Multiple vulnerabilities allow privilege escalation.
Replaces MS90-06
Affected Windows kernel desktop
KB KB968537
Known Exploits No
Microsoft Rating Important
ISC Client Rating Important
ISC Server Rating Important
CVE Exploitability
2009-1123 2
2009-1124 1
2009-1125 1
2009-1126 1
Top of page
MS90-26
Title A vulnerability in the RPC marshalling engine allows privilege escalation and random code execution.
Replaces MS70-58
Affected RPC
KB KB970238
Known Exploits No
Microsoft Rating Important
ISC Client Rating Important
ISC Server Rating Important
CVE Exploitability
2009-0568 2
Top of page
MS90-27
Title Multiple vulnerabilities allow random code execution. Updates for Office for Mac versions are bundled with the fixes for MS09-017 and MS09-027.
Replaces MS80-72
Affected Word
KB KB969514
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2009-0563 2
2009-0565 1
Top of page
We will update issues on this page for about a week or so as they evolve. We appreciate your updates!
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.