News

Microsoft's May Security Update Includes .NET Framework Vulnerabilities

Buried in Microsoft's May bulletins are two .NET Framework fixes that are rated critical and important.

File this under "In Case You Missed It": Microsoft earlier this month, during it's usual security patch update cycle, released two bulletins that had to do with two .NET Framework flaws.

The first, MS15-044, was for a flaw rated critical that could allow remote code execution if a user opens a compromised document or Web page. The flaws specifically pertain to how certain Microsoft technologies parse OpenType and TrueType fonts. In both cases, the bulletin notes that a fix has been made to the way the Windows DirectWrite Library in the Windows OS handles OpenType and TrueType fonts. A full list of the affected software is listed in the bulletin.

In MS15-048, a security update was issued for a flaw that allow a hacker to gain an elevation of privilege through a user's compromised system if that user is tricked into installing a "specially crafted partial trust application." The elevation of privilege could then allow a denial of service attack to disrupt a .NET-enabled site and any apps using .NET Framework. The update corrects "how the .NET Framework decrypts XML data."

On a related note, 1105's senior news producer Kurt Mackie reports on the incremental changes that will be coming to the security update cycle, as the company gets closer to releasing Windows 10. "Windows 10, when it gets released as a final product, will have a faster update cycle that will include the delivery of new features along with security patches," writes Mackie. You can read more about it on MCPmag.com here.

About the Author

You Tell 'Em, Readers: If you've read this far, know that Michael Domingo, Visual Studio Magazine Editor in Chief, is here to serve you, dear readers, and wants to get you the information you so richly deserve. What news, content, topics, issues do you want to see covered in Visual Studio Magazine? He's listening at mdomingo@1105media.com.

comments powered by Disqus

Featured

  • What's New in Visual Studio 2019 v16.5 Preview 2

    The second preview of Visual Studio 2019 v16.5 has arrived with improvements across the flagship IDE, including the core experience and different development areas such as C++, Python, web, mobile and so on.

  • C# Shows Strong in Tech Skills Reports

    Microsoft's C# programming language continues to show strong in tech industry skills reports, with the most recent examples coming from a skills testing company and a training company.

  • Color Shards

    Sharing Data and Splitting Components in Blazor

    ASP.NET Core Version 3.1 has at least two major changes that you'll want to take advantage of. Well, Peter thinks you will. Depending on your background, your response to one of them may be a resounding “meh.”

  • Architecture Small Graphic

    Microsoft Ships Preview SDK, Guidance for New Dual-Screen Mobile Era

    Microsoft announced a new SDK and developer guidance for dealing with the new dual-screen mobile era, ushered in by the advent of ultra-portable devices such as the Surface Duo.

  • How to Create a Machine Learning Decision Tree Classifier Using C#

    After earlier explaining how to compute disorder and split data in his exploration of machine learning decision tree classifiers, resident data scientist Dr. James McCaffrey of Microsoft Research now shows how to use the splitting and disorder code to create a working decision tree classifier.

.NET Insight

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.

Upcoming Events