Internet Explorer patches gets top billing

Microsoft on Tuesday released eight fixes to address 23 vulnerabilities that lie across its software and operating system components.

Most notable is bulletin MS11-081, a "critical" patch that closes eight privately reported holes in Internet Explorer (IE) and affects all supported versions, including IE 9. Some of the vulnerabilities can be exploited simply by a user visiting a malicious website.

The only other critical fix is MS11-078, which repairs a privately reported vulnerability in .NET Framework and Silverlight.

"The vulnerability could allow remote code execution on a client system if a user views a specially crafted web page using a web browser that can run XAML Browser Applications (XBAPs) or Silverlight applications," according to Microsoft.

Jason Miller, a researcher at VMware, reminded users that deploying a patch such as MS11-078 may take some time.

"It is important to note that Microsoft .NET Framework patches from Microsoft typically take quite a while to run through the patching process," he said. "The patches can also be quite large for each version of the program."

Vulnerability experts said the six remaining bulletins are considered lower priority. However, at least two of them, MS11-075 and -076, address an issue that Microsoft has been dealing with for more than a year. The software giant has been closing off similar vulnerabilities since last summer, when it issued an advisory after research revealed that a new class of vulnerabilities known as DLL (dynamic-link Library) preloading can be exploited remotely by an attacker who places a malicious library on a network share.

This article originally appeared at scmagazineus.com