Microsoft Patch Tuesday 2012-04-10

MS12-023
Title Cumulative update for Internet Explorer adding fixes for 5 more random code execution vulnerabilities with the rights of the logged-on user.
Replaces MS12-010
Affected MSIE
KB KB2675157
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2012-0168 1
Top of page
MS12-024
Title An input validation vulnerability in the parsing of the signatures on executable files allows random code execution with the rights of the logged on user.
Replaces MS10-019
Affected Windows Authenticode
KB KB2653956
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2012-0151 1
Top of page
MS12-025
Title An input validation failure in the .NET framework allows random code execution with the rights of the logged on user. This not only affects users browsing websites but also IIS servers running ASP.NET in e.g. a web hosting scenario.
Replaces
Affected .NET
KB KB2671605
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2012-0163 1
Top of page
MS12-026
Title Vulnerabilities in Forefront UAG (Unified Access Gateway) allow unfiltered access to internal resources and spoofing of the UAG webserver (directing the visitor to malicious sites instead of the UAG server, potentially compromising their login credentials
Replaces
Affected Forefront UAG
KB KB2663860
Known Exploits No
Microsoft Rating Important
ISC Client Rating N/A
ISC Server Rating N/A
CVE Exploitability
2012-0146 3
Top of page
MS12-027
Title A vulnerability in Windows Common Controls [ActiveX] allows random code execution with the rights of the logged-on user. Attack vectors include websites and email attachments. Also affects a whole lot of other Microsoft software such as SQL server, Commer
Replaces
Affected Windows Common Controls
KB KB2664258
Known Exploits Yes
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2012-0158 1
Top of page
MS12-028
Title An input validation vulnerability in the .wps converter allows random code execution with the rights of the logged on user.
Replaces MS90-24, MS10-105
Affected Office - works
KB KB2639185
Known Exploits No
Microsoft Rating Important
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2012-0177 1
Top of page
We will update issues on this page for about a week or so as they evolve. We appreciate your updates!
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.