The toStaticHTML API (aka the SafeHTML component) in Microsoft Internet Explorer 8 and 9, Communicator 2007 R2, and Lync 2010 and 2010 Attendee does not properly handle event attributes and script, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted HTML document, aka "HTML Sanitization Vulnerability."
Publish Date : 2012-06-12 Last Update Date : 2013-03-06
OVAL (Open Vulnerability and Assessment Language) definitions define exactly what should be done to verify
a vulnerability or a missing patch. Check out the OVAL definitions
if you want to learn what you should do to verify a vulnerability.
http://www.us-cert.gov/cas/techalerts/TA12-164A.html
CERT TA12-164A |
http://www.us-cert.gov/cas/techalerts/TA12-192A.html
CERT TA12-192A |
http://technet.microsoft.com/en-us/security/bulletin/ms12-039
Microsoft Security Bulletin MS12-039 MS12-039 - Important : Vulnerabilities in Lync Could Allow Remote Code Execution (2707956) - Version: 1.0
Severity Rating: Important
Revision Note: V1.0 (June 12, 2012): Bulletin published.
Summary: This security update resolves one publicly disclosed vulnerability and three privately reported vulnerabilities in Microsoft Lync. The most severe vulnerabilities could allow remote code execution if a user views shared content that contains specially crafted TrueType fonts.Release Date:2012-06-12 |
http://technet.microsoft.com/en-us/security/bulletin/ms12-037
Microsoft Security Bulletin MS12-037 MS12-037 - Critical : Cumulative Security Update for Internet Explorer (2699988) - Version: 1.0
Severity Rating: Critical
Revision Note: V1.0 (June 12, 2012): Bulletin published.
Summary: This security update resolves one publicly disclosed and twelve privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.Release Date:2012-06-12 |
http://technet.microsoft.com/en-us/security/bulletin/ms12-050
Microsoft Security Bulletin MS12-050 MS12-050 - Important : Vulnerabilities in SharePoint Could Allow Elevation of Privilege (2695502) - Version: 2.1
Severity Rating: Important
Revision Note: V2.1 (December 12, 2012): Clarified that the update for Microsoft SharePoint Services 2.0 is available from the Microsoft Download Center only.
Summary: This security update resolves one publicly disclosed and five privately reported vulnerabilities in Microsoft SharePoint and Windows SharePoint Services. The most severe vulnerabilities could allow elevation of privilege if a user clicks a specially crafted URL that takes the user to a targeted SharePoint site.Release Date:2012-12-12 |
