News
Microsoft's May Security Update Includes .NET Framework Vulnerabilities
Buried in Microsoft's May bulletins are two .NET Framework fixes that are rated critical and important.
File this under "In Case You Missed It": Microsoft earlier this month, during it's usual security patch update cycle, released two bulletins that had to do with two .NET Framework flaws.
The first, MS15-044, was for a flaw rated critical that could allow remote code execution if a user opens a compromised document or Web page. The flaws specifically pertain to how certain Microsoft technologies parse OpenType and TrueType fonts. In both cases, the bulletin notes that a fix has been made to the way the Windows DirectWrite Library in the Windows OS handles OpenType and TrueType fonts. A full list of the affected software is listed in the bulletin.
In MS15-048, a security update was issued for a flaw that allow a hacker to gain an elevation of privilege through a user's compromised system if that user is tricked into installing a "specially crafted partial trust application." The elevation of privilege could then allow a denial of service attack to disrupt a .NET-enabled site and any apps using .NET Framework. The update corrects "how the .NET Framework decrypts XML data."
On a related note, 1105's senior news producer Kurt Mackie reports on the incremental changes that will be coming to the security update cycle, as the company gets closer to releasing Windows 10. "Windows 10, when it gets released as a final product, will have a faster update cycle that will include the delivery of new features along with security patches," writes Mackie. You can read more about it on MCPmag.com here.
About the Author
You Tell 'Em, Readers: If you've read this far, know that Michael Domingo, Visual Studio Magazine Editor in Chief, is here to serve you, dear readers, and wants to get you the information you so richly deserve. What news, content, topics, issues do you want to see covered in Visual Studio Magazine? He's listening at [email protected].