Microsoft Patches Zero-Day Bug & 15 Other Flaws
Summary: Microsoft released MS12-043, a critical patch for a vulnerability in Microsoft XML Core Services that attackers and malware had been using to break into systems, alongside at least 15 other fixes. An exploit for the XML flaw had been added to the BlackHole Exploit Kit late the previous month, and Microsoft also urged customers to stop using the Sidebar and Gadgets in Windows 7 and Windows Vista.
Bottom line: The XML flaw moved from limited, targeted attacks into BlackHole, an automated browser exploit kit popular in the criminal underground, which turns a targeted bug into a broad, opportunistic one. Microsoft's own guidance on Gadgets - that some do not follow secure coding practices and pose risk to the systems running them - leaves a class of desktop code that administrators must now block themselves.
Read the original at Krebs on Security ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026