Microsoft Thursday said it will release seven security updates next week—including one rated critical for Windows 8 and Windows RT—to patch 12 vulnerabilities in Windows, Office, SharePoint Server and the company’s website design software.
At the same time, Microsoft warned customers that hackers are using digital certificates obtained from a Turkish certificate authority (CA). In response, Microsoft has removed the purloined certificates from Windows’ list of trusted certificates, and urged users to verify that they have applied a June 2012 update that automates the de-certification process.
Missing from Thursday’s advance notification was any news about the Internet Explorer (IE) zero-day vulnerability that hackers have been exploiting since at least Dec. 7.
Microsoft declined to comment on Thursday when asked about the timetable for the IE fix.
In an emailed statement, Dustin Childs, a group manager in Microsoft’s security group, again said that the firm has found few attacks exploiting the IE bug. “We’ve seen only a limited number of affected customers,” Childs claimed.
