Microsoft plans big May patch slate for next week
Schedules seven updates to patch 23 bugs in Windows, Office
Computerworld - Microsoft today said it would ship seven security updates next week, three critical, to patch 23 bugs in Windows, Office and its Silverlight and .Net development platforms.
The number of patches -- nearly two dozen -- is higher than usual for an odd-numbered month; for some time, Microsoft has used an even-odd schedule, patching more vulnerabilities in the even months, when it also regularly updates Internet Explorer.
"May has been a light month, historically, very light," said Andrew Storms, director of security operations at nCircle Security, who tracks the number of patches and updates Microsoft issues each month.
In May 2011, Microsoft shipped two update that patched three vulnerabilities. The year before, it delivered two updates that patched two bugs.
"So, this is a big number," said Storms.
The pace so far this year -- Microsoft's collections during the first five months have included seven, nine, six, six and seven updates -- puts to rest the idea that Microsoft still hews to a wave-and-trough practice.
"Certainly for bulletin count, it looks like a pretty flat line to me," said Storms, using the term "bulletin" -- Microsoft's label -- to describe security updates. "This year, it looks like the up and down pattern has ended."
Wolfgang Kandek, CTO of Qualys, agreed with Storms.
"In prior years we have seen much stronger differences [in the number of updates each month], ranging from 2 to 17," Kandek said in an email. "We are not sure this [flattening] is intended, but it makes the workload much more predictable and is preferable to the more bursty release mode."
Of the seven updates, Microsoft tagged three as "critical," the highest threat ranking in its four-step system, and the other four as "important," the next-most serious score.
Four updates will address vulnerabilities in Windows; four will impact Office, Microsoft's popular application suite; and one will affect the Silverlight development framework. That count exceeds seven because one of updates tackles bugs in all three of those lines.
The large number of Office updates caught Storms' eye: Three of the pending bulletins are Office-only, while one is shared with Windows and Silverlight. The trio of Office-only updates will patch flaws in Word, Excel and Visio. The latter is a little-used commercial diagramming program that's considered part of the Office family.
"There's a heavy lean toward Office here," Storms noted.
Storms pointed his finger at what Microsoft labeled Bulletin 2 as the most likely to rise to the top of the to-do list next week. His reasons: It was pegged critical, impacts virtually every edition of Windows, applies to all currently-supported versions of Office on Windows and also patches one or more bugs in Silverlight.
- Warning: Cloud Data at Risk Experts agree that relying on SaaS vendors to backup and restore your data is dangerous. Yet that's exactly what huge portions of the...
- The Opportunities and Challenges of the Cloud In this report F5 poses questions to IDC analysts, Sally Hudson and Phil Hochmuth, on behalf of F5's customers to better understand the...
- Mobile First: Securing Information Sprawl Learn how the partnership between Box and MobileIron can help you execute a "mobile first" strategy that manages and secures both mobile apps...
- The Truth About Cloud Security "Security" is the number one issue holding business leaders back from the cloud. But does the reality match the perception?
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!