Microsoft Patch Tuesday 2013-03-12

MS13-021
Title The usual MSIE cumulative patch, adding fixes for eight more vulnerabilities. All 8 are of the "use after free" type and they all allow random code execution.
Replaces MS13-009
Affected MSIE
KB KB2809289
Known Exploits Yes
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-0087 1
Top of page
MS13-022
Title A double dereference vulnerability that allows random code execution in Silverlight. This also affects the mac version of silverlight 5. The update is expected via the auto-update feature on Macs.
Replaces MS12-034
Affected Silverlight
KB KB2814124
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-0074 1
Top of page
MS13-023
Title A memory management vulnerability allow random code execution in the Visio viewer. The full package is exempt from this problem.
Replaces MS12-059
Affected Visio Viewer
KB KB2801261
Known Exploits No
Microsoft Rating Critical
ISC Client Rating Critical
ISC Server Rating Critical
CVE Exploitability
2013-0079 2
Top of page
MS13-024
Title Four different privilege escalation vulnerabilities in Sharepoint. Of note: it includes an XSS and a directory traversal vulnerability in addition to a problem with callback functions and a buffer overflow.
Replaces MS12-066
Affected Sharepoint
KB KB2780176
Known Exploits No
Microsoft Rating Critical
ISC Client Rating N/A
ISC Server Rating N/A
CVE Exploitability
2013-0080 1
Top of page
MS13-025
Title A buffer management problem allows leaking arbitrary data in memory. It could expose usernames and passwords of accounts.
Replaces
Affected OneNote
KB KB2816264
Known Exploits No
Microsoft Rating Important
ISC Client Rating Important
ISC Server Rating Important
CVE Exploitability
2013-0086 3
Top of page
MS13-026
Title When previewing or opening an email that contain HTML5, outlook for Mac can load content from random webservers without user interaction. The note is quite confusing. E.g.: every mac capable of running the affected versions has a webkit browser installed
Replaces MS12-076
Affected Outlook for Mac
KB KB2813682
Known Exploits No
Microsoft Rating Important
ISC Client Rating Less urgent
ISC Server Rating Less urgent
CVE Exploitability
2013-0095 3
Top of page
MS13-027
Title 3 similar problems exist with the windows USB drivers that allow privilege escalation to full administrative rights.
Replaces
Affected USB Kernel Mode Drivers
KB KB2807986
Known Exploits No
Microsoft Rating Important
ISC Client Rating Important
ISC Server Rating Important
CVE Exploitability
2013-1285 1
Top of page
We will update issues on this page for about a week or so as they evolve. We appreciate your updates!
US based customers can call Microsoft for free patch related support on 1-866-PCSAFETY
(*): ISC rating
  • We use 4 levels:
    • PATCH NOW: Typically used where we see immediate danger of exploitation. Typical environments will want to deploy these patches ASAP. Workarounds are typically not accepted by users or are not possible. This rating is often used when typical deployments make it vulnerable and exploits are being used or easy to obtain or make.
    • Critical: Anything that needs little to become "interesting" for the dark side. Best approach is to test and deploy ASAP. Workarounds can give more time to test.
    • Important: Things where more testing and other measures can help.
    • Less Urgent: practices for servers such as not using outlook, MSIE, word etc. to do traditional office or leisure work.
    • The rating is not a risk analysis as such. It is a rating of importance of the vulnerability and the perceived or even predicted threatatches.