[BigFix-Announcements] BES Auto Notification: New Fixlets Published in Fixlet Site: 'Patches for Windows (English)'

Thu Dec 12 02:02:06 PST 2013

Fixlet Site - 'Patches for Windows (English)'
Current Version: 1890	Published: Wed, 11 Dec 2013 18:20:35  GMT

New Fixlets:
============

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Windows Vista SP2
Severity: Critical
Fixlet ID: 1309601
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Windows Vista SP2 (x64)
Severity: Critical
Fixlet ID: 1309603
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Windows Server 2008 SP2
Severity: Critical
Fixlet ID: 1309605
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Windows Server 2008 SP2 (x64)
Severity: Critical
Fixlet ID: 1309607
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Office 2003 SP3 / Word Viewer
Severity: Critical
Fixlet ID: 1309609
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Office 2007 SP3 / Office Compatibility Pack SP3 / Excel Viewer
Severity: Critical
Fixlet ID: 1309611
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Office 2010 SP1/SP2 / PowerPoint 2010 Viewer SP1/SP2 (2817670)
Severity: Critical
Fixlet ID: 1309613
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Office 2010 SP1/SP2 (x64)
Severity: Critical
Fixlet ID: 1309615
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Lync 2010
Severity: Important
Fixlet ID: 1309617
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Lync 2010 (x64)
Severity: Important
Fixlet ID: 1309619
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Lync 2010 Attendee (user level install)
Severity: Important
Fixlet ID: 1309621
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Lync 2010 Attendee (admin level install)
Severity: Important
Fixlet ID: 1309623
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Lync 2013 / Lync Basic 2013
Severity: Important
Fixlet ID: 1309625
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-096: Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution - Lync 2013 / Lync Basic 2013 (x64)
Severity: Important
Fixlet ID: 1309627
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-096

Fixlet Description: Microsoft has released a security update that resolves a publicly disclosed vulnerability in Microsoft Windows, Microsoft Office, and Microsoft Lync. The vulnerability could allow remote code execution if a user views content that contains specially crafted TIFF files After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-100: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution - SharePoint Server 2013 (coreserverloc) (x64)
Severity: Important
Fixlet ID: 1310001
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-100

Fixlet Description: Microsoft has released a security update that resolves multiple privately reported vulnerabilities in Microsoft Office server software. These vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a SharePoint server. An attacker who successfully exploited these vulnerabilities could run arbitrary code in the security context of the W3WP service account on the target SharePoint site. After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-100: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution - SharePoint Server 2010 SP1/SP2 - Business Productivity Servers (x64)
Severity: Important
Fixlet ID: 1310003
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-100

Fixlet Description: Microsoft has released a security update that resolves multiple privately reported vulnerabilities in Microsoft Office server software. These vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a SharePoint server. An attacker who successfully exploited these vulnerabilities could run arbitrary code in the security context of the W3WP service account on the target SharePoint site. After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-100: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution - SharePoint Server 2013 - Business Productivity Servers (x64)
Severity: Important
Fixlet ID: 1310005
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-100

Fixlet Description: Microsoft has released a security update that resolves multiple privately reported vulnerabilities in Microsoft Office server software. These vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a SharePoint server. An attacker who successfully exploited these vulnerabilities could run arbitrary code in the security context of the W3WP service account on the target SharePoint site. After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-100: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution - SharePoint Server 2013 - Excel Services (x64)
Severity: Important
Fixlet ID: 1310007
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-100

Fixlet Description: Microsoft has released a security update that resolves multiple privately reported vulnerabilities in Microsoft Office server software. These vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a SharePoint server. An attacker who successfully exploited these vulnerabilities could run arbitrary code in the security context of the W3WP service account on the target SharePoint site. After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-100: Vulnerabilities in Microsoft SharePoint Server Could Allow Remote Code Execution - Office Web Apps 2013 - Office Web Apps Server 2013 (x64)
Severity: Important
Fixlet ID: 1310009
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-100

Fixlet Description: Microsoft has released a security update that resolves multiple privately reported vulnerabilities in Microsoft Office server software. These vulnerabilities could allow remote code execution if an authenticated attacker sends specially crafted page content to a SharePoint server. An attacker who successfully exploited these vulnerabilities could run arbitrary code in the security context of the W3WP service account on the target SharePoint site. After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-103: Vulnerability in ASP.NET SignalR Could Allow Elevation of Privilege - Visual Studio Team Foundation Server 2013
Severity: Important
Fixlet ID: 1310301
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-103

Fixlet Description: Microsoft has released a security update that resolves a privately reported vulnerability in ASP.NET SignalR. The vulnerability could allow elevation of privilege if an attacker reflects specially crafted JavaScript back to the browser of a targeted user After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-103: Vulnerability in ASP.NET SignalR Could Allow Elevation of Privilege - ASP.NET SignalR 1.1.x / 2.0.x
Severity: Important
Fixlet ID: 1310303
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-103

Fixlet Description: Microsoft has released a security update that resolves a privately reported vulnerability in ASP.NET SignalR. The vulnerability could allow elevation of privilege if an attacker reflects specially crafted JavaScript back to the browser of a targeted user After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability. 

Important Note: .

***************************************************************
Title: MS13-104: Vulnerability in Microsoft Office Could Allow Information Disclosure - Office 2013
Severity: Important
Fixlet ID: 1310401
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-104

Fixlet Description: Microsoft has released a security update that resolves one privately reported vulnerability in Microsoft Office that could allow information disclosure if a user attempts to open an Office file hosted on a malicious website. An attacker who successfully exploited this vulnerability could ascertain access tokens used to authenticate the current user on a targeted SharePoint or other Microsoft Office server site. After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-104: Vulnerability in Microsoft Office Could Allow Information Disclosure - Office 2013 (x64)
Severity: Important
Fixlet ID: 1310403
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-104

Fixlet Description: Microsoft has released a security update that resolves one privately reported vulnerability in Microsoft Office that could allow information disclosure if a user attempts to open an Office file hosted on a malicious website. An attacker who successfully exploited this vulnerability could ascertain access tokens used to authenticate the current user on a targeted SharePoint or other Microsoft Office server site. After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-105: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution - Exchange Server 2007 SP3
Severity: Critical
Fixlet ID: 1310501
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-105

Fixlet Description: Microsoft has released a security update that resolves three publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft Exchange Server. The most severe of these vulnerabilities exist in the WebReady Document Viewing and Data Loss Prevention features of Microsoft Exchange Server. These vulnerabilities could allow remote code execution in the security context of the LocalService account if an attacker sends an email message containing a specially crafted file to a user on an affected Exchange server. The LocalService account has minimum privileges on the local system and presents anonymous credentials on the network After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-105: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution - Exchange Server 2010 SP2 (x64)
Severity: Critical
Fixlet ID: 1310503
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-105

Fixlet Description: Microsoft has released a security update that resolves three publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft Exchange Server. The most severe of these vulnerabilities exist in the WebReady Document Viewing and Data Loss Prevention features of Microsoft Exchange Server. These vulnerabilities could allow remote code execution in the security context of the LocalService account if an attacker sends an email message containing a specially crafted file to a user on an affected Exchange server. The LocalService account has minimum privileges on the local system and presents anonymous credentials on the network After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-105: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution - Exchange Server 2010 SP3 (x64)
Severity: Critical
Fixlet ID: 1310505
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-105

Fixlet Description: Microsoft has released a security update that resolves three publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft Exchange Server. The most severe of these vulnerabilities exist in the WebReady Document Viewing and Data Loss Prevention features of Microsoft Exchange Server. These vulnerabilities could allow remote code execution in the security context of the LocalService account if an attacker sends an email message containing a specially crafted file to a user on an affected Exchange server. The LocalService account has minimum privileges on the local system and presents anonymous credentials on the network After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-105: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution - Exchange Server 2013 Cumulative Update 2 (x64)
Severity: Critical
Fixlet ID: 1310507
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-105

Fixlet Description: Microsoft has released a security update that resolves three publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft Exchange Server. The most severe of these vulnerabilities exist in the WebReady Document Viewing and Data Loss Prevention features of Microsoft Exchange Server. These vulnerabilities could allow remote code execution in the security context of the LocalService account if an attacker sends an email message containing a specially crafted file to a user on an affected Exchange server. The LocalService account has minimum privileges on the local system and presents anonymous credentials on the network After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-105: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution - Exchange Server 2013 Cumulative Update 3 (x64)
Severity: Critical
Fixlet ID: 1310509
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-105

Fixlet Description: Microsoft has released a security update that resolves three publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft Exchange Server. The most severe of these vulnerabilities exist in the WebReady Document Viewing and Data Loss Prevention features of Microsoft Exchange Server. These vulnerabilities could allow remote code execution in the security context of the LocalService account if an attacker sends an email message containing a specially crafted file to a user on an affected Exchange server. The LocalService account has minimum privileges on the local system and presents anonymous credentials on the network After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-105: Vulnerabilities in Microsoft Exchange Server Could Allow Remote Code Execution - Exchange Server 2007 SP3 (x64)
Severity: Critical
Fixlet ID: 1310511
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-105

Fixlet Description: Microsoft has released a security update that resolves three publicly disclosed vulnerabilities and one privately reported vulnerability in Microsoft Exchange Server. The most severe of these vulnerabilities exist in the WebReady Document Viewing and Data Loss Prevention features of Microsoft Exchange Server. These vulnerabilities could allow remote code execution in the security context of the LocalService account if an attacker sends an email message containing a specially crafted file to a user on an affected Exchange server. The LocalService account has minimum privileges on the local system and presents anonymous credentials on the network After downloading and installing this update, affected computers will no longer be susceptible to these vulnerabilities.

***************************************************************
Title: MS13-106: Vulnerability in a Microsoft Office Shared Component Could Allow Security Feature Bypass - Office 2007 SP3
Severity: Important
Fixlet ID: 1310601
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-106

Fixlet Description: Microsoft has released a security update that resolves one publicly disclosed vulnerability in a Microsoft Office shared component that is currently being exploited. The vulnerability could allow security feature bypass if a user views a specially crafted webpage in a web browser capable of instantiating COM components, such as Internet Explorer. In a web-browsing attack scenario, an attacker who successfully exploited this vulnerability could bypass the Address Space Layout Randomization (ASLR) security feature, which helps protect users from a broad class of vulnerabilities. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability that could take advantage of the ASLR bypass to run arbitrary code. After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-106: Vulnerability in a Microsoft Office Shared Component Could Allow Security Feature Bypass - Office 2010 SP1/SP2
Severity: Important
Fixlet ID: 1310603
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-106

Fixlet Description: Microsoft has released a security update that resolves one publicly disclosed vulnerability in a Microsoft Office shared component that is currently being exploited. The vulnerability could allow security feature bypass if a user views a specially crafted webpage in a web browser capable of instantiating COM components, such as Internet Explorer. In a web-browsing attack scenario, an attacker who successfully exploited this vulnerability could bypass the Address Space Layout Randomization (ASLR) security feature, which helps protect users from a broad class of vulnerabilities. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability that could take advantage of the ASLR bypass to run arbitrary code. After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: MS13-106: Vulnerability in a Microsoft Office Shared Component Could Allow Security Feature Bypass - Office 2010 SP1/SP2 (x64)
Severity: Important
Fixlet ID: 1310605
Fixlet Link: http://technet.microsoft.com/en-us/security/bulletin/MS13-106

Fixlet Description: Microsoft has released a security update that resolves one publicly disclosed vulnerability in a Microsoft Office shared component that is currently being exploited. The vulnerability could allow security feature bypass if a user views a specially crafted webpage in a web browser capable of instantiating COM components, such as Internet Explorer. In a web-browsing attack scenario, an attacker who successfully exploited this vulnerability could bypass the Address Space Layout Randomization (ASLR) security feature, which helps protect users from a broad class of vulnerabilities. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability that could take advantage of the ASLR bypass to run arbitrary code. After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability.

***************************************************************
Title: 2834140: "0x00000050" Stop error after you install update 2670838 on a computer that is running Windows 7 SP1 or Windows Server 2008 R2 SP1 - Windows Server 2008 R2 SP1 (x64)
Severity: N/A
Fixlet ID: 283414001
Fixlet Link: http://support.microsoft.com/kb/2834140

Fixlet Description: Install this update to resolve issues in Windows. After downloading and installing this update, affected computers will no longer be susceptible to this vulnerability. 