News

Microsoft's May Security Update Includes .NET Framework Vulnerabilities

Buried in Microsoft's May bulletins are two .NET Framework fixes that are rated critical and important.

File this under "In Case You Missed It": Microsoft earlier this month, during it's usual security patch update cycle, released two bulletins that had to do with two .NET Framework flaws.

The first, MS15-044, was for a flaw rated critical that could allow remote code execution if a user opens a compromised document or Web page. The flaws specifically pertain to how certain Microsoft technologies parse OpenType and TrueType fonts. In both cases, the bulletin notes that a fix has been made to the way the Windows DirectWrite Library in the Windows OS handles OpenType and TrueType fonts. A full list of the affected software is listed in the bulletin.

In MS15-048, a security update was issued for a flaw that allow a hacker to gain an elevation of privilege through a user's compromised system if that user is tricked into installing a "specially crafted partial trust application." The elevation of privilege could then allow a denial of service attack to disrupt a .NET-enabled site and any apps using .NET Framework. The update corrects "how the .NET Framework decrypts XML data."

On a related note, 1105's senior news producer Kurt Mackie reports on the incremental changes that will be coming to the security update cycle, as the company gets closer to releasing Windows 10. "Windows 10, when it gets released as a final product, will have a faster update cycle that will include the delivery of new features along with security patches," writes Mackie. You can read more about it on MCPmag.com here.

About the Author

You Tell 'Em, Readers: If you've read this far, know that Michael Domingo, Visual Studio Magazine Editor in Chief, is here to serve you, dear readers, and wants to get you the information you so richly deserve. What news, content, topics, issues do you want to see covered in Visual Studio Magazine? He's listening at [email protected].

comments powered by Disqus

Featured

  • AI for GitHub Collaboration? Maybe Not So Much

    No doubt GitHub Copilot has been a boon for developers, but AI might not be the best tool for collaboration, according to developers weighing in on a recent social media post from the GitHub team.

  • Visual Studio 2022 Getting VS Code 'Command Palette' Equivalent

    As any Visual Studio Code user knows, the editor's command palette is a powerful tool for getting things done quickly, without having to navigate through menus and dialogs. Now, we learn how an equivalent is coming for Microsoft's flagship Visual Studio IDE, invoked by the same familiar Ctrl+Shift+P keyboard shortcut.

  • .NET 9 Preview 3: 'I've Been Waiting 9 Years for This API!'

    Microsoft's third preview of .NET 9 sees a lot of minor tweaks and fixes with no earth-shaking new functionality, but little things can be important to individual developers.

  • Data Anomaly Detection Using a Neural Autoencoder with C#

    Dr. James McCaffrey of Microsoft Research tackles the process of examining a set of source data to find data items that are different in some way from the majority of the source items.

  • What's New for Python, Java in Visual Studio Code

    Microsoft announced March 2024 updates to its Python and Java extensions for Visual Studio Code, the open source-based, cross-platform code editor that has repeatedly been named the No. 1 tool in major development surveys.

Subscribe on YouTube