New Office Bulletin Fixes 6 Critical Flaws

Flaws allowing remote code execution in Microsoft Office and elevation of privilege in Windows were the source for two security bulletins posted by the software giant on Tuesday.

Microsoft had warned customers last week that the two bulletins would be coming.

The Office bulletin is the more serious of the two. Rated critical, bulletin MS06-012 actually includes fixes for six distinct critical flaws. Some of the vulnerabilities were privately reported, as Microsoft requests, while others had been made public. According to Microsoft, all the flaws involve malformed inputs and are fixed in a similar way.

The flaws affect applications in the Office 2000, Office XP, Office 2003, Office X for Mac, Office 2004 for Mac and Microsoft Works suites.

The Windows bulletin, MS06-011, involves a publicly-disclosed vulnerability involving certain Windows services. The elevation of privileges flaw could allow an attacker to take complete control of an affected system. While the flaw is rated an "important" risk in Windows XP Service Pack 1 and a "moderate" risk in Windows Server 2003, it is non-existent in Windows XP SP2 and Windows Server 2003 SP1.

About the Author

Scott Bekker is editor in chief of Redmond Channel Partner magazine.


  • Microsoft Issues Windows Server HTTP/2 Attack Advisory

    Microsoft issued Security Advisory ADV190005 on Wednesday concerning a potential HTTP/2 settings issue for users of Internet Information Services (IIS) on Windows Server.

  • Performing a Storage Refresh on Windows Server 2016, Part 2

    Earlier, Brien walked through the steps of preparing a physical Windows Server 2016 machine for a storage refresh. Now, he shows how to complete the process, all the way to OS restoration.

  • New Office App Coming to Windows 10 Users

    Microsoft is delivering a new Office app for Windows 10 consumer and business users over the new few weeks, according to a Wednesday announcement.

  • Microsoft Warns .NET Core 1.0 and 1.1 Losing Support in June

    Microsoft gave notice this week that .NET Core 1.0 and 1.1 will fall out of support on June 27, 2019.

comments powered by Disqus

Office 365 Watch

Sign up for our newsletter.

Terms and Privacy Policy consent

I agree to this site's Privacy Policy.