IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Microsoft's July Patch Tuesday to feature 2 critical fixes

Microsoft has notified users of upcoming security fixes, including two critical-rated vulnerabilities

Patch Tuesday

Microsoft will be rolling out two critical fixes during its monthly Patch Tuesday round of security updates.

There are six notifications in all, with two ranked critical, three important and one listed as only moderate.

The average since 2013 has been around nine per month, so the six announced for next week represent a lower bulletin count than usual.

Of the two labelled critical, one is related to Internet Explorer, and is more than likely to be a patch that collects a number of updates needed to the browser. This marks the sixth Patch Tuesday in a row that's featured updates for the browser.

Wolfgang Kandek, CTO of Qualys, highlighted the importance of the IE update in a blog post. "This patch should be top of your list, since most attacks involve your web browser in some way.

"Take a look at the most recent numbers in Microsoft SIR report v16, which illustrate clearly that web- based attacks, which include Java and Adobe Flash are the most common," he added.

The second critical bulletin resolves remote code execution issues with all versions of Windows currently available, including Windows RT and RT 8.1.

Arriving third, fourth and fifth, the "important" bulletins address issues around privilege elevation. All the vulnerabilities addressed by these bulletins are local, meaning they cannot be executed through  a network connection.

That doesn't mitigate the danger, claims Kandek, as an attacker who gains access to a computer through stolen credentials can still control the user's computer with them.

Bulletin six, ranked the lowest in importance with a "moderate" rating, fixes denial-of-service vulnerabilities in Microsoft's server software.

"All of the vulnerabilities in this month's release were discovered by Microsoft or privately disclosed by security researchers," said Karl Sigler, threat intelligence manager at Trustwave. "The good news is that none of these vulnerabilities have been exploited in the wild yet."

Full details of each bulletin will be released when the patches go live next Tuesday

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

Microsoft reportedly blocks Russian Windows 10 and Windows 11 downloads
Microsoft Windows

Microsoft reportedly blocks Russian Windows 10 and Windows 11 downloads

20 Jun 2022
IT Pro News in Review: UK tech raises $16bn, Microsoft acquires Miburo, largest DDoS attack mitigated
Business strategy

IT Pro News in Review: UK tech raises $16bn, Microsoft acquires Miburo, largest DDoS attack mitigated

17 Jun 2022
Proofpoint details 'dangerous' ransomware flaw in SharePoint and OneDrive
ransomware

Proofpoint details 'dangerous' ransomware flaw in SharePoint and OneDrive

17 Jun 2022
Microsoft silent patches called “a grossly irresponsible policy”
cyber security

Microsoft silent patches called “a grossly irresponsible policy”

15 Jun 2022

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
The UK's best cities for tech workers in 2022
Business strategy

The UK's best cities for tech workers in 2022

24 Jun 2022
LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022