Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

11/9/2012
02:16 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Windows 8, RT Get First Security Fixes

Microsoft's first set of Windows 8 and Windows RT patches for critical vulnerabilities hits next week.

Microsoft Pop-Up Stores: Hands-On Look
Microsoft Pop-Up Stores: Hands-On Look
(click image for larger view and for slideshow)
Windows 8 and Windows RT, released just two weeks ago, are about to receive their first security makeover.

Microsoft on Thursday said that it plans to release its first security patches for Windows 8 and Windows RT as part of its monthly patch cycle next week.

Six security bulletins are scheduled for release, addressing a total of 19 vulnerabilities. Three of the bulletins apply to Windows 8, each of which has been designated critical. Two of the bulletins apply to Windows RT, one of which is critical.

Microsoft won't disclose specifics about the flaws until the patch is released to the public, but the Windows 8 vulnerabilities all allow remote code execution. One of them also affects Microsoft .NET Framework.

[ Get expert guidance on Microsoft Windows 8. InformationWeek's Windows 8 Super Guide rounds up the key news, analysis, and reviews that you need. ]

Other Microsoft software affected includes Windows XP, Windows Vista, Windows 7, Server 2003, Server 2008, and Server 2012. Also affected are Microsoft Internet Explorer 9; Microsoft Excel 2003, 2007, 2010; Microsoft Office for Mac 2008, 2011; Microsoft Excel Viewer; and Microsoft Office Compatibility Pack.

With regard to the two Windows RT vulnerabilities, both the critical one and the important one could allow remote code execution. Users who have chosen to enable automatic updating will receive the patches, as might be expected, automatically.

Versions of Internet Explorer prior to IE9 are not being patched. Neither is IE10, which ships with Windows 8 and Windows RT.

That doesn't mean IE10 is not without potential problems: On October 30, French security firm VUPEN claimed that it had identified a vulnerability affecting Windows 8 and Internet Explorer 10. Unfortunately for Microsoft customers, VUPEN sells information about the vulnerabilities it finds to its clients rather than disclosing the information to Microsoft or the public.

Upgrading isn't the easy decision that Win 7 was. We take a close look at Server 2012, changes to mobility and security, and more in the new Here Comes Windows 8 issue of InformationWeek. Also in this issue: Why you should have the difficult conversations about the value of OS and PC upgrades before discussing Windows 8. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PJS880
50%
50%
PJS880,
User Rank: Ninja
11/17/2012 | 6:30:25 PM
re: Windows 8, RT Get First Security Fixes
Why not just bundle the IE updates along with the other patches? Glad to see the at least they are keeping the Windows updates up to par. I foresee users unhappy who are running Windows 8, and unaware of the IE updates and vulnerabilities due to not receiving them.

Paul Sprague
InformationWeek Contributor
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8103
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8104
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8105
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8106
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8058
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation coul...