Topic: 2 Surprise Security Updates Coming From Microsoft

[georgecloner]

Microsoft has announced that they will issue 2 "out of band" updates next Tuesday, July 28. One is for Internet Explorer and is of Critical severity. The other, strangely, is for Visual Studio and is only rated Moderate.

Often you can guess what the updates are for, but in this case I'm confused. There has been a lot of chatter recently about various vulnerabilities, especially since will start next week BlackHat and Defcon right after it. I have to guess that the Visual Studio update is somehow related to the IE vulnerability, perhaps helping programmers to address related vulnerabilities in their own programs.

The best guess I have is the one that, superficially, was patched last week by Microsoft, the bug in the MS Video Control. As I had pointed out earlier, Microsoft had known about this problem for a long time, discovered that it was much messier than it at first appeared, and was hoping to address it more comprehensively. Perhaps this is that update. There are aspects of that bug that could justify updates to Visual Studio.

See Halvar Flake's blog, which was the original research on the problem. Word is that Microsoft called him up in the middle of the night to beg him not to disclose more, and Flake seems to have gone along. The prospect of a near-term update, such as next Tuesday, might have done it for him.

But this is all speculation for now. The important thing is to be ready to consider and apply updates next Tuesday.

[PCMAG]

[zahdab]

i am sure whoever had his birthday that day was actually surprised