Bugs and fixes: zero-day patch for Internet Explorer 6 or 7

A critical bug in IE; plus patches for Office, Java, Shockwave, and Mac OS X.

A dangerous vulnerability in Internet Explorer 6 and 7 became publicly known before a fix was available, raising the specter of a high-risk zero-day attack. The bug involves the way IE handles Cascading Style Sheets (CSS) objects, and could let an attacker run any command on a targeted Windows XP, Vista, Server 2003, or Server 2008 PC. Bad guys have already posted sample attack code online. IE 8 is not affected. For more information, see Microsoft Security Advisory 977981. Meanwhile, a bug in the way Windows handles Embedded OpenType could allow a baddie to take over vulnerable Windows XP, 2000, or Server 2003 computers via malicious Websites or poisoned Office documents. The bug can't harm Vista or Server 2008, and doesn't affect Windows 7. Read Microsoft Security Bulletin MS09-065 for details.

Office File Flaws

Two other patches repair Office flaws in Excel and Word affecting Office XP and 2003, and Office 2004 and 2008 for Mac. The Excel bug endangers Office 2007, Office Excel Viewer 2003, and the Office Excel Viewer Service Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats. The Word flaw also affects Open XML File Format Converter for Mac, Office Word Viewer 2003, and Office Word Viewer. Microsoft rates the flaws as im­­portant; see Microsoft Security Bulletin MS09-067 (Ex­­cel) and Microsoft Security Bulletin MS09-068 (Word).Microsoft has also released two critical fixes for business networks. One closes a hole in the Web Services on Devices application programming interface; it's critical for Vista and Server 2008 (see Microsoft Security Bulletin MS09-063). The second flaw affects only Windows 2000 systems running License Logging Server (see Microsoft Security Bulletin MS09-064).

Java and Opera Bump Up

Sun's Java Runtime Environment (JRE) and Java Development Kit (JDK) Update 17 closes a number of holes, including a serious flaw that allows attacks via Web pages. Java will check monthly to see whether updates are available, but you can check manually, too: Open Control Panel and double-click the Java icon. On the Update tab, click Update now. After updating, you may need to remove old Java versions manually with Add or Remove Programs. For details, or to download the latest Java, head to Sun's Java SE Downloads page.

Version 10.10 of Opera's Web browser fixes numerous bugs, including one that might let malicious JavaScript on a Web page launch an attack. Click Help, Check for updates to confirm that you have the latest version of Opera; if not, you can download Opera 10.10 from PCWorld's Downloads Library.

Fix Shockwave and Mac OS X

An attack on critical vulnerabilities in Shockwave Player versions prior to 11.5.1.601 could "run malicious code on an affected system," Adobe says. Check your Shockwave version at Adobe's special testing page, and get the latest iteration (Shockwave 11.5.2.602) from our Downloads pages.

Finally, the Mac OS X 10.6.2 update corrects various problems involving PDF files, H.264 movies, TIFF images, and other things. Get it via Software Update, and read more at About Security Update 2009-006.

Tags security patchMicrosoft Windows

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Erik Larkin

PC World (US online)

Comments

Comments are now closed.

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?