News

Microsoft's May Security Update Includes .NET Framework Vulnerabilities

Buried in Microsoft's May bulletins are two .NET Framework fixes that are rated critical and important.

File this under "In Case You Missed It": Microsoft earlier this month, during it's usual security patch update cycle, released two bulletins that had to do with two .NET Framework flaws.

The first, MS15-044, was for a flaw rated critical that could allow remote code execution if a user opens a compromised document or Web page. The flaws specifically pertain to how certain Microsoft technologies parse OpenType and TrueType fonts. In both cases, the bulletin notes that a fix has been made to the way the Windows DirectWrite Library in the Windows OS handles OpenType and TrueType fonts. A full list of the affected software is listed in the bulletin.

In MS15-048, a security update was issued for a flaw that allow a hacker to gain an elevation of privilege through a user's compromised system if that user is tricked into installing a "specially crafted partial trust application." The elevation of privilege could then allow a denial of service attack to disrupt a .NET-enabled site and any apps using .NET Framework. The update corrects "how the .NET Framework decrypts XML data."

On a related note, 1105's senior news producer Kurt Mackie reports on the incremental changes that will be coming to the security update cycle, as the company gets closer to releasing Windows 10. "Windows 10, when it gets released as a final product, will have a faster update cycle that will include the delivery of new features along with security patches," writes Mackie. You can read more about it on MCPmag.com here.

About the Author

You Tell 'Em, Readers: If you've read this far, know that Michael Domingo, Visual Studio Magazine Editor in Chief, is here to serve you, dear readers, and wants to get you the information you so richly deserve. What news, content, topics, issues do you want to see covered in Visual Studio Magazine? He's listening at [email protected].

comments powered by Disqus

Featured

  • Uno Platform Ports Windows Calculator to Linux

    Uno Platform has ported the famed Windows Calculator, open sourced last year, to Linux as part of a continuing "proof point" effort to demonstrate the reach of what it describes as the sole UI offering available to target Windows, WebAssembly, iOS, macOS, Android and Linux with single-codebase applications coded in C# and XAML.

  • ASP.NET Core OData 8 Preview Supports .NET 5, but with Breaking Changes

    ASP.NET Core OData, which debuted in July 2018, is out in a v8.0 preview that for the first time supports the upcoming .NET 5 milestone release.

  • VS Code Java Team Details 5 Best Dev Practices

    Microsoft's Visual Studio Code team for Java development added a new Coding Pack for Java installer and detailed best practices for setting up a development environment.

  • Binary Classification Using PyTorch: Defining a Network

    Dr. James McCaffrey of Microsoft Research tackles how to define a network in the second of a series of four articles that present a complete end-to-end production-quality example of binary classification using a PyTorch neural network, including a full Python code sample and data files.

  • Blazor Debugging Boosted in .NET 5 RC 2

    In highlighting updates to ASP.NET Core in the just-launched second and final Release Candidate of .NET 5, Microsoft pointed out better debugging for Blazor, the red-hot project that allows for C# coding of web projects.

Upcoming Events