Affected software includes several Microsoft operating systems and Microsoft Office, take a look at the listing below for additional details on every security bulletin released today.

• Microsoft Security Bulletin MS10-042 – Critical
  Vulnerability in Help and Support Center Could Allow Remote Code Execution (2229593) – This security update resolves a publicly disclosed vulnerability in the Windows Help and Support Center feature that is delivered with supported editions of Windows XP and Windows Server 2003. This vulnerability could allow remote code execution if a user views a specially crafted Web page using a Web browser or clicks a specially crafted link in an e-mail message. The vulnerability cannot be exploited automatically through e-mail. For an attack to be successful, a user must click a link listed within an e-mail message.
• Microsoft Security Bulletin MS10-043 – Critical
  Vulnerability in Canonical Display Driver Could Allow Remote Code Execution (2032276) – This security update resolves a publicly disclosed vulnerability in the Canonical Display Driver (cdd.dll). Although it is possible that the vulnerability could allow code execution, successful code execution is unlikely due to memory randomization. In most scenarios, it is much more likely that an attacker who successfully exploited this vulnerability could cause the affected system to stop responding and automatically restart.
• Microsoft Security Bulletin MS10-044 – Critical
  Vulnerabilities in Microsoft Office Access ActiveX Controls Could Allow Remote Code Execution – This security update resolves two privately reported vulnerabilities in Microsoft Office Access ActiveX Controls. The vulnerabilities could allow remote code execution if a user opened a specially crafted Office file or viewed a Web page that instantiated Access ActiveX controls. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
• Microsoft Security Bulletin MS10-045 – Important
  Vulnerability in Microsoft Office Outlook Could Allow Remote Code Execution (978212) – This security update resolves a privately reported vulnerability. The vulnerability could allow remote code execution if a user opened an attachment in a specially crafted e-mail message using an affected version of Microsoft Office Outlook. An attacker who successfully exploited this vulnerability could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights

microsoft security updates

microsoft patch day deployment priority

Affected software:

• MS10-042 – Windows XP, Windows XP Pro 64-bit, Windows Server 2003, Windows Server 2003 64-bit
• MS10-043 – Windows 7 for x64-based Systems, Windows Server 2008 R2 for x64-based Systems
• MS10-044 – Microsoft Office 2003 , Microsoft Office 2007
• MS10-045 – Microsoft Office XP, Microsoft Office 2003, Microsoft Office 2007

All vulnerabilities allow remote code execution on compromised systems. Additional information about this months’ patches are available at the Technet blog post.

Microsoft Windows and Microsoft Office users are encouraged to update their computer systems as soon as possible to protect the PCs from possible exploits that could attack the systems successfully. The usual options to download the patches are provided including automatic updates, Windows updates, Microsoft update or manually by following the links posted in the different security bulletins.

• MS09-063 Vulnerability in Web Services on Devices API Could Allow Remote Code Execution (973565) – This security update resolves a privately reported vulnerability in the Web Services on Devices Application Programming Interface (WSDAPI) on the Windows operating system. The vulnerability could allow remote code execution if an affected Windows system receives a specially crafted packet. Only attackers on the local subnet would be able to exploit this vulnerability.
• MS09-064 – Vulnerability in License Logging Server Could Allow Remote Code Execution (974783) – This security update resolves a privately reported vulnerability in Microsoft Windows 2000. The vulnerability could allow remote code execution if an attacker sent a specially crafted network message to a computer running the License Logging Server. An attacker who successfully exploited this vulnerability could take complete control of the system. Firewall best practices and standard default firewall configurations can help protect networks from attacks that originate outside the enterprise perimeter.
• MS09-065 – Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (969947) – This security update resolves several privately reported vulnerabilities in the Windows kernel. The most severe of the vulnerabilities could allow remote code execution if a user viewed content rendered in a specially crafted Embedded OpenType (EOT) font. In a Web-based attack scenario, an attacker would have to host a Web site that contains specially crafted embedded fonts that are used to attempt to exploit this vulnerability. In addition, compromised Web sites and Web sites that accept or host user-provided content could contain specially crafted content that could exploit this vulnerability. An attacker would have no way to force users to visit a specially crafted Web site. Instead, an attacker would have to convince the user to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes the user to the attacker’s site.
• MS09-066 – Vulnerability in Active Directory Could Allow Denial of Service (973309) – This security update resolves a privately reported vulnerability in Active Directory directory service, Active Directory Application Mode (ADAM), and Active Directory Lightweight Directory Service (AD LDS). The vulnerability could allow denial of service if stack space was exhausted during execution of certain types of LDAP or LDAPS requests. This vulnerability only affects domain controllers and systems configured to run ADAM or AD LDS.
• MS09-067 – Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (972652) – This security update resolves several privately reported vulnerabilities in Microsoft Office Excel. The vulnerabilities could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
• MS09-068 – Vulnerability in Microsoft Office Word Could Allow Remote Code Execution (976307) – This security update resolves a privately reported vulnerability that could allow remote code execution if a user opens a specially crafted Word file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Detailed information are available in the security bulletins linked above or at the security bulletin summary page here.

• Vulnerabilities in Microsoft Office Excel Could Cause Remote Code Execution (968557)
• Vulnerabilities in WordPad and Office Text Converters Could Allow Remote Code Execution (960477)
• Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (961373)
• Vulnerabilities in Windows Could Allow Elevation of Privilege (959454)
• Vulnerabilities in Windows HTTP Services Could Allow Remote Code Execution (960803)
• Cumulative Security Update for Internet Explorer (963027)
• Blended Threat Vulnerability in SearchPath Could Allow Elevation of Privilege (959426)
• Vulnerabilities in Microsoft ISA Server and Forefront Threat Management Gateway (Medium Business Edition) Could Cause Denial of Service (961759)

The easiest way to update is by visiting Windows Update or Microsoft Update. Please read our Windows Update Fix article if Windows Update is not working properly on your computer system. Alternatives are so called offline updates like Offline Update, Autopatcher or Update Windows Without Microsoft.

It is recommended to update the computer system as soon as possible to close the vulnerabilities.

Microsoft Office Slipstreamer looks pretty much alike and one could think that both software programs have been developed by the same person. There are however some differences that are worth to be mentioned. The latter supports Office 2000 and above while Office 2000 is not supported (yet) by Microsoft Office Integrator. That leaves Office 2000 users with no other choice but to select Microsoft Office Slipstreamer.

Both applications work the same way. The user begins by picking the setup.exe of his Office installation disk and a destination for the installation disk that will be created. He then picks Service Packs and Hotfixes for his Office product which will be integrated into Office which is the greatest benefit of slipstreamed software.

It is possible to enter the Office product key so that it is entered automatically during installation. Microsoft Office Slipstreamer can also fill out the Organization automatically. The user can also point at additional files that should be installed after Office setup has finished. That’s called Chained Installations.

Both support the creation of AIO (All In One) CD or DVDs and to create Iso images that can be burned easily. It basically comes down to Office 2000 support versus no Office 2000 support.