Latest Security Advisories https://technet.microsoft.com/en-us/security/advisory MTPS_SecurityBulletin_RSS_Generator en-us Copyright (C) 2020 Microsoft Corporation 4053440 - Securely opening Microsoft Office documents that contain Dynamic Data Exchange (DDE) fields - Version: 3.0 https://technet.microsoft.com/en-us/library/security/4053440 2018-01-09T18:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information regarding security settings for Microsoft Office applications. This advisory provides guidance on what users can do to ensure that these applications are properly secured when processing Dynamic Data Exchange (DDE) fields.]]> 4056318 - Guidance for securing AD DS account used by Azure AD Connect for directory synchronization - Version: 1.0 https://technet.microsoft.com/en-us/library/security/4056318 2017-12-12T18:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information regarding security settings for the AD DS (Active Directory Domain Services) account used by Azure AD Connect for directory synchronization. This advisory also provides guidance on what on-premises AD administrators can do to ensure that the account is properly secured.]]> 4038556 - Guidance for securing applications that host the WebBrowser Control - Version: 1.0 https://technet.microsoft.com/en-us/library/security/4038556 2017-08-08T17:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information regarding security settings for applications developed with the Microsoft Internet Explorer layout engine, also known as the Trident layout engine. This advisory also provides guidance on what developers and individuals can do to ensure that their applications hosting the WebBrowser Control are properly secured.]]> 4033453 - Vulnerability in Azure AD Connect Could Allow Elevation of Privilege - Version: 1.0 https://technet.microsoft.com/en-us/library/security/4033453 2017-06-27T17:00:00.0000000Z Summary: Microsoft is releasing this security advisory to inform customers that a new version of Azure Active Directory (AD) Connect is available that addresses an Important security vulnerability.]]> 4025685 - Guidance related to June 2017 security update release - Version: 1.0 https://technet.microsoft.com/en-us/library/security/4025685 2017-06-13T17:00:00.0000000Z Summary: Microsoft is announcing the availability of additional guidance for critical security updates, that are at heightened risk of exploitation due to past and threatened nation-state attacks and disclosures. Some of the releases are new, and some are for older platforms that we are making publicly available today.]]> 4022345 - Identifying and correcting failure of Windows Update client to receive updates - Version: 1.3 https://technet.microsoft.com/en-us/library/security/4022345 2017-05-12T17:00:00.0000000Z Revision Note: V1.3 (May 12, 2017): Updated FAQ to clarify the update that needs to be installed: “the current cumulative update”. This is an informational change only.
Summary: Microsoft is releasing this security advisory to provide information related to an uncommon deployment scenario in which the Windows Update Client may not properly scan for, or download, updates.]]>
4022344 - Security Update for Microsoft Malware Protection Engine - Version: 1.2 https://technet.microsoft.com/en-us/library/security/4022344 2017-05-12T17:00:00.0000000Z Revision Note: V1.2 (May 12, 2017): Added entries into the affected software table. This is an informational change only.
Summary: Microsoft is releasing this security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft.]]>
4021279 - Vulnerabilities in .NET Core, ASP.NET Core Could Allow Elevation of Privilege - Version: 1.1 https://technet.microsoft.com/en-us/library/security/4021279 2017-05-10T17:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information about vulnerabilities in the public .NET Core and ASP.NET Core. This advisory also provides guidance on what developers can do to update their applications correctly.]]> 4010323 - Deprecation of SHA-1 for SSL/TLS Certificates in Microsoft Edge and Internet Explorer 11 - Version: 1.0 https://technet.microsoft.com/en-us/library/security/4010323 2017-05-09T17:00:00.0000000Z Summary: Beginning May 9, 2017, Microsoft released updates to Microsoft Edge and Internet Explorer 11 to block sites that are protected with a SHA-1 certificate from loading and displays an invalid certificate warning. This change will only impact SHA-1 certificates that chain to a Microsoft Trusted Root CA where the end-entity certificate or the issuing intermediate uses SHA-1. Manually-installed enterprise or self-signed SHA-1 certificates will not be impacted, although we recommend that all customers quickly migrate to SHA-2. For more information, please see Windows Enforcement of SHA1 Certificates.]]> 3123479 - SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0 https://technet.microsoft.com/en-us/library/security/3123479 2017-03-14T17:00:00.0000000Z Summary: Microsoft is announcing a policy change to the Microsoft Root Certificate Program.]]> 4010983 - Vulnerability in ASP.NET Core MVC 1.1.0 Could Allow Denial of Service - Version: 1.0 https://technet.microsoft.com/en-us/library/security/4010983 2017-01-27T18:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in the public versions of ASP.NET Core MVC 1.1.0. This advisory also provides guidance on what developers can do to update their applications correctly.]]> 3214296 - Vulnerabilities in Identity Model Extensions Token Signing Verification Could Allow Elevation of Privilege - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3214296 2017-01-10T18:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in the public version of Identity Model Extensions 5.1.0. This advisory also provides guidance on what developers can do to help ensure that their apps are updated correctly.]]> 3181759 - Vulnerabilities in ASP.NET Core View Components Could Allow Elevation of Privilege - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3181759 2016-09-13T17:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in the public versions of ASP.NET Core MVC 1.0.0. This advisory also provides guidance on what developers can do to help ensure that their applications are updated correctly.]]> 3174644 - Updated Support for Diffie-Hellman Key Exchange - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3174644 2016-09-13T17:00:00.0000000Z Summary: ]]> 3179528 - Update for Kernel Mode Disallowlist - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3179528 2016-08-09T17:00:00.0000000Z Summary: Microsoft is disallowlisting some publically released versions of securekernel.exe. This advisory includes a list of hashes for specific operating systems that are on the disallow list]]> 2880823 - Deprecation of SHA-1 Hashing Algorithm for Microsoft Root Certificate Program - Version: 2.0 https://technet.microsoft.com/en-us/library/security/2880823 2016-05-18T17:00:00.0000000Z Summary: Microsoft is announcing a policy change to the Microsoft Root Certificate Program. The new policy will no longer allow root certificate authorities to issue X.509 certificates using the SHA-1 hashing algorithm for the purposes of SSL and code signing after January 1, 2016. Using the SHA-1 hashing algorithm in digital certificates could allow an attacker to spoof content, perform phishing attacks, or perform man-in-the-middle attacks.]]> 3155527 - Update to Cipher Suites for FalseStart - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3155527 2016-05-10T17:00:00.0000000Z Summary: FalseStart allows the TLS client to send application data before receiving and verifying the server Finished message. This allows an attacker to launch a man-in-the-middle (MiTM) attack to force the TLS client to encrypt the first flight of application_data records using the attacker’s chosen cipher suite from the client’s list. To avoid downgrade attacks, TLS clients only allow FalseStart when their strongest cipher suites are negotiated.]]> 3152550 - Update to Improve Wireless Mouse Input Filtering - Version: 1.1 https://technet.microsoft.com/en-us/library/security/3152550 2016-04-22T17:00:00.0000000Z Summary: Microsoft is announcing the availability of an update to improve input filtering for certain Microsoft wireless mouse devices. The update enhances security by filtering out QWERTY key packets in keystroke communications issued from receiving USB wireless dongles to wireless mouse devices. This improvement is part of ongoing efforts to improve the effectiveness of security in Windows and Microsoft devices. For more information, see Microsoft Knowledge Base Article 3152550.]]> 3137909 - Vulnerabilities in ASP.NET Templates Could Allow Tampering - Version: 1.1 https://technet.microsoft.com/en-us/library/security/3137909 2016-02-10T18:00:00.0000000Z Summary: Microsoft is releasing this security advisory to provide information about a vulnerability in the public versions of Visual Studio 2013, Visual Studio 2015, ASP.NET MVC5, and ASP.NET MVC6. This advisory also provides guidance on what developers can do to help ensure that the controls and components that they have built are not subject to the vulnerability.]]> 2871997 - Update to Improve Credentials Protection and Management - Version: 5.0 https://technet.microsoft.com/en-us/library/security/2871997 2016-02-09T18:00:00.0000000Z Summary: Microsoft is announcing the availability of updates for supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 that improve credential protection and domain authentication controls to reduce credential theft.]]> 3118753 - Updates for ActiveX Kill Bits 3118753 - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3118753 2016-01-12T18:00:00.0000000Z Summary: Microsoft is releasing a new set of ActiveX kill bits with this advisory. These ActiveX kill bits are included in the Internet Explorer cumulative update released on January 12, 2016.]]> 3109853 - Update to Improve TLS Session Resumption Interoperability - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3109853 2016-01-12T18:00:00.0000000Z Summary: Microsoft is announcing the availability of an update to improve interoperability between Schannel-based TLS clients and 3rd-party TLS servers that enable RFC5077-based resumption and that send the NewSessionTicket message in the abbreviated TLS handshake. The update addresses an issue in schannel.dll that could cause RFC5077 session ticket-based resumption to fail and subsequently cause WinInet-based clients (for example, Internet Explorer and Microsoft Edge) to perform a fallback to a lower TLS protocol version than the one that would have been negotiated otherwise. This improvement is part of ongoing efforts to bolster the effectiveness of encryption in Windows.]]> 2755801 - Update for Vulnerabilities in Adobe Flash Player in Internet Explorer and Microsoft Edge - Version: 53.0 https://technet.microsoft.com/en-us/library/security/2755801 2016-01-05T18:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for Adobe Flash Player in Internet Explorer on all supported editions of Windows 8, Windows Server 2012, Windows RT, Windows 8.1, Windows Server 2012 R2, Windows RT 8.1, and Windows 10; the update is also available for Adobe Flash Player in Microsoft Edge on all supported editions of Windows 10. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10, Internet Explorer 11, and Microsoft Edge. ]]> 3057154 - Update to Harden Use of DES Encryption - Version: 1.1 https://technet.microsoft.com/en-us/library/security/3057154 2015-12-08T18:00:00.0000000Z Summary: Microsoft is announcing the availability of an update to harden scenarios in which Data Encryption Standard (DES) encryption keys are used with accounts to ensure that domain users, services, and computers that support other encryption types are not vulnerable to credential theft or elevation of privilege attacks. DES is considered a weak cipher due to well-known brute force and faster than brute force attacks. The cryptographic algorithm has also been removed from the standard [RFC 6649]. To further protect our users, Microsoft has disabled DES by default in Windows 7 and Windows Server 2008 R2 and later operating systems. However, this update does allow DES to be used between client and server to address scenarios in which DES is still required for application compatibility reasons. The improvement is part of ongoing efforts to bolster the effectiveness of encryption in Windows and still support legacy line-of-business (LOB) applications.]]> 3123040 - Inadvertently Disclosed Digital Certificate Could Allow Spoofing - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3123040 2015-12-08T18:00:00.0000000Z Summary: Microsoft is aware of an SSL/TLS digital certificate for *.xboxlive.com for which the private keys were inadvertently disclosed. The certificate could be used in attempts to perform man-in-the-middle attacks. It cannot be used to issue other certificates, impersonate other domains, or sign code. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue.]]> 3119884 - Inadvertently Disclosed Digital Certificates Could Allow Spoofing - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3119884 2015-11-30T18:00:00.0000000Z Summary: Microsoft is aware of unconstrained digital certificates from Dell Inc. for which the private keys were inadvertently disclosed. One of these unconstrained certificates could be used to issue other certificates, impersonate other domains, or sign code. In addition, these certificates could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against Dell customers. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue.]]> 3108638 - Update for Windows Hyper-V to Address CPU Weakness - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3108638 2015-11-10T18:00:00.0000000Z Summary: Microsoft is announcing the availability of a security update for Windows Hyper-V to protect against a denial of service condition that can be triggered with certain central processing unit (CPU) chipsets. Although the weakness resides in the chipset, Microsoft is issuing this security update to protect customers. The update prevents guests on a Hyper-V system from triggering a weakness in the CPU that could allow instructions from a Hyper-V guest to place its Hyper-V host's CPU into an unresponsive state, leading to a denial of service condition for the guest operating systems running on the affected host. Successful exploitation of the CPU weakness would require kernel-mode code execution privileges on the guest operating system.]]> 3042058 - Update to Default Cipher Suite Priority Order - Version: 1.1 https://technet.microsoft.com/en-us/library/security/3042058 2015-10-13T17:00:00.0000000Z Summary: On May 12, 2015, Microsoft announced the availability of an update to cryptographic cipher suite prioritization in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2. The update added additional cipher suites to the default list on affected systems and improved cipher suite priority ordering. The improvements were in keeping with ongoing efforts to bolster the effectiveness of encryption in Windows operating systems.]]> 3097966 - Inadvertently Disclosed Digital Certificates Could Allow Spoofing - Version: 2.0 https://technet.microsoft.com/en-us/library/security/3097966 2015-10-13T17:00:00.0000000Z Summary: Microsoft is aware of four digital certificates that were inadvertently disclosed by D-Link Corporation that could be used in attempts to spoof content. The disclosed end-entity certificates cannot be used to issue other certificates or impersonate other domains, but could be used to sign code. This issue affects all supported releases of Microsoft Windows.]]> 2960358 - Update for Disabling RC4 in .NET TLS - Version: 2.0 https://technet.microsoft.com/en-us/library/security/2960358 2015-10-13T17:00:00.0000000Z Summary: On May 13, 2014, Microsoft announced the availability of an update for Microsoft .NET Framework that disables RC4 in Transport Layer Security (TLS) through the modification of the system registry. Use of RC4 in TLS could allow an attacker to perform man-in-the-middle attacks and recover plaintext from encrypted sessions.]]> 3083992 - Update to Improve AppLocker Publisher Rule Enforcement - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3083992 2015-09-08T17:00:00.0000000Z Summary: Microsoft is announcing the availability of a defense-in-depth update that improves the enforcement of publisher rules by Windows AppLocker in Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, Windows 8.1, and Windows Server 2012 R2. The improvement is part of ongoing efforts to bolster the effectiveness of security controls in Windows.]]> 3074162 - Vulnerability in Microsoft Malicious Software Removal Tool Could Allow Elevation of Privilege - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3074162 2015-07-14T17:00:00.0000000Z Revision Note: V1.0 (July 14, 2015): Advisory published
Summary: Microsoft is releasing this security advisory to inform customers that an update to the Microsoft Malicious Software Removal Tool (MSRT) is available that addresses a security vulnerability that was reported to Microsoft. The vulnerability could allow elevation of privilege if an attacker logs on to a target system and places a specially crafted dynamic link library (.dll) file in a local directory. An authenticated attacker who successfully exploited the vulnerability could elevate privileges on a target system. An attacker could then install programs; view, change, or delete data; or create new accounts with full administrative rights.]]>
2962393 - Update for Vulnerability in Juniper Networks Windows In-Box Junos Pulse Client - Version: 2.0 https://technet.microsoft.com/en-us/library/security/2962393 2015-06-09T17:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for the Juniper Networks Windows In-Box Junos Pulse Client for Windows 8.1 and Windows RT 8.1. The update addresses a vulnerability in the Juniper VPN client by updating the affected Juniper VPN client libraries contained in affected versions of Microsoft Windows.]]> 3062591 - Local Administrator Password Solution (LAPS) Now Available - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3062591 2015-05-01T17:00:00.0000000Z Summary: Microsoft is offering the Local Administrator Password Solution (LAPS) that provides a solution to the issue of using a common local account with an identical password on every computer in a domain. LAPS resolves this issue by setting a different, random password for the common local administrator account on every computer in the domain. Domain administrators using the solution can determine which users, such as helpdesk administrators, are authorized to read passwords.]]> 3045755 - Update to Improve PKU2U Authentication - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3045755 2015-04-14T17:00:00.0000000Z Summary: Microsoft is announcing the availability of a defense-in-depth update that improves the authentication used by the Public Key Cryptography User-to-User (PKU2U) security support provider (SSP) in Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1. The improvement is part of ongoing efforts to bolster the effectiveness of security controls in Windows.]]> 3009008 - Vulnerability in SSL 3.0 Could Allow Information Disclosure - Version: 3.0 https://technet.microsoft.com/en-us/library/security/3009008 2015-04-14T17:00:00.0000000Z Summary: Microsoft is aware of detailed information that has been published describing a new method to exploit a vulnerability in SSL 3.0. This is an industry-wide vulnerability affecting the SSL 3.0 protocol itself and is not specific to the Windows operating system. All supported versions of Microsoft Windows implement this protocol and are affected by this vulnerability. Microsoft is not aware of attacks that try to use the reported vulnerability at this time. Considering the attack scenario, this vulnerability is not considered high risk to customers.]]> 3050995 - Improperly Issued Digital Certificates Could Allow Spoofing - Version: 2.0 https://technet.microsoft.com/en-us/library/security/3050995 2015-03-26T17:00:00.0000000Z Summary: Microsoft is aware of improperly issued digital certificates coming from the subordinate CA, MCS Holdings, which could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. The improperly issued certificates cannot be used to issue other certificates, impersonate other domains, or sign code. This issue affects all supported releases of Microsoft Windows.]]> 3046310 - Improperly Issued Digital Certificates Could Allow Spoofing - Version: 2.0 https://technet.microsoft.com/en-us/library/security/3046310 2015-03-19T17:00:00.0000000Z Summary: Microsoft is aware of an improperly issued SSL certificate for the domain “live.fi” that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue.]]> 3046015 - Vulnerability in Schannel Could Allow Security Feature Bypass - Version: 2.0 https://technet.microsoft.com/en-us/library/security/3046015 2015-03-10T17:00:00.0000000Z Revision Note: V2.0 (March 10, 2015): Advisory updated to reflect publication of security bulletin.
Summary: Microsoft has completed the investigation into a public report of a vulnerability. We have issued Microsoft Security Bulletin MS15-031 to address this issue. For more information about this issue, including download links for an available security update, please review the security bulletin. The vulnerability addressed is the Schannel Security Feature Bypass Vulnerability - CVE-2015-1637.]]>
3033929 - Availability of SHA-2 Code Signing Support for Windows 7 and Windows Server 2008 R2 - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3033929 2015-03-10T17:00:00.0000000Z Summary: Microsoft is announcing the reissuance of an update for all supported editions of Windows 7 and Windows Server 2008 R2 to add support for SHA-2 signing and verification functionality. This update supersedes the 2949927 update that was rescinded on October 17, 2014 to address issues that some customers experienced after installation. As with the original release, Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT, and Windows RT 8.1 do not require this update as SHA-2 signing and verification functionality is already included in these operating systems. This update is not available for Windows Server 2003, Windows Vista, or Windows Server 2008.]]> 3004375 - Update for Windows Command Line Auditing - Version: 1.0 https://technet.microsoft.com/en-us/library/security/3004375 2015-02-10T18:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for supported editions of Windows 7, Windows 8, Windows Server 2008R2 and Windows Server 2012 that expands the Audit Process Creation policy to include the command information passed to every process. This is a new feature that provides valuable information to help administrators monitor, troubleshoot, and investigate security-related activities on their networks. For more information, see Microsoft Knowledge Base Article 3004375.]]> 3010060 - Vulnerability in Microsoft OLE Could Allow Remote Code Execution - Version: 2.0 https://technet.microsoft.com/en-us/library/security/3010060 2014-11-11T18:00:00.0000000Z Summary: Microsoft has completed the investigation into a public report of a vulnerability. We have issued Microsoft Security Bulletin MS14-064 to address this issue. For more information about this issue, including download links for an available security update, please review the security bulletin. The vulnerability addressed is the Windows OLE Remote Code Execution Vulnerability - CVE-2014-6352.]]> 2949927 - Availability of SHA-2 Hashing Algorithm for Windows 7 and Windows Server 2008 R2 - Version: 2.0 https://technet.microsoft.com/en-us/library/security/2949927 2014-10-17T17:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for all supported editions of Windows 7 and Windows Server 2008 R2 to add support for SHA-2 signing and verification functionality. Windows 8, Windows 8.1, Windows Server 2012, Windows Server 2012 R2, Windows RT, and Windows RT 8.1 do not require this update as SHA-2 signing and verification functionality is already included in these operating systems. This update is not available for Windows Server 2003, Windows Vista, or Windows Server 2008]]> 2977292 - Update for Microsoft EAP Implementation that Enables the Use of TLS - Version: 1.0 https://technet.microsoft.com/en-us/library/security/2977292 2014-10-14T17:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for supported editions of Windows 7, Windows Server 2008 R2, Windows 8, Windows 8.1, Windows Server 2012, and Windows RT for the Microsoft Extensible Authentication Protocol (EAP) implementation that enables the use of Transport Layer Security (TLS) 1.1 or 1.2 through the modification of the system registry. For more information, see Microsoft Knowledge Base Article 2977292.]]> 2905247 - Insecure ASP.NET Site Configuration Could Allow Elevation of Privilege - Version: 2.0 https://technet.microsoft.com/en-us/library/security/2905247 2014-09-09T17:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for Microsoft ASP.NET to address a vulnerability in ASP.NET view state that exists when Machine Authentication Code (MAC) validation is disabled through configuration settings. The vulnerability could allow elevation of privilege and affects all supported versions of Microsoft .NET Framework except .NET Framework 3.0 Service Pack 2 and Microsoft .NET Framework 3.5 Service Pack 1.]]> 2915720 - Changes in Windows Authenticode Signature Verification - Version: 1.4 https://technet.microsoft.com/en-us/library/security/2915720 2014-07-29T17:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for all supported releases of Microsoft Windows to change how signatures are verified for binaries signed with the Windows Authenticode signature format. The change is included with Security Bulletin MS13-098, but will only be enabled on an opt-in basis. When enabled, the new default behavior for Windows Authenticode signature verification will no longer allow extraneous information in the WIN_CERTIFICATE structure, and Windows will no longer recognize non-compliant binaries as signed.]]> 2982792 - Improperly Issued Digital Certificates Could Allow Spoofing - Version: 2.0 https://technet.microsoft.com/en-us/library/security/2982792 2014-07-17T17:00:00.0000000Z Summary: Microsoft is aware of improperly issued SSL certificates that could be used in attempts to spoof content, perform phishing attacks, or perform man-in-the-middle attacks. The SSL certificates were improperly issued by the National Informatics Centre (NIC), which operates subordinate CAs under root CAs operated by the Government of India Controller of Certifying Authorities (CCA), which are CAs present in the Trusted Root Certification Authorities Store. This issue affects all supported releases of Microsoft Windows. Microsoft is not currently aware of attacks related to this issue.]]> 2974294 - Vulnerability in Microsoft Malware Protection Engine Could Allow Denial of Service - Version: 1.0 https://technet.microsoft.com/en-us/library/security/2974294 2014-06-17T17:00:00.0000000Z Summary: Microsoft is releasing this security advisory to inform customers that an update to the Microsoft Malware Protection Engine addresses a security vulnerability that was reported to Microsoft. The vulnerability could allow denial of service if the Microsoft Malware Protection Engine scans a specially crafted file. An attacker who successfully exploited this vulnerability could prevent the Microsoft Malware Protection Engine from monitoring affected systems until the specially crafted file is manually removed and the service is restarted.]]> 2862973 - Update for Deprecation of MD5 Hashing Algorithm for Microsoft Root Certificate Program - Version: 3.0 https://technet.microsoft.com/en-us/library/security/2862973 2014-06-10T17:00:00.0000000Z Summary: Microsoft is announcing the availability of an update for supported editions of Windows Vista, Windows Server 2008, Windows 7, Windows Server 2008 R2, Windows 8, Windows Server 2012, and Windows RT that restricts the use of certificates with MD5 hashes. This restriction is limited to certificates issued under roots in the Microsoft root certificate program. Usage of MD5 hash algorithm in certificates could allow an attacker to spoof content, perform phishing attacks, or perform man-in-the-middle attacks.]]> 2962824 - Update Rollup of Revoked Non-Compliant UEFI Modules - Version: 1.1 https://technet.microsoft.com/en-us/library/security/2962824 2014-06-10T17:00:00.0000000Z Summary: With this advisory, Microsoft is revoking the digital signature for four private, third-party UEFI (Unified Extensible Firmware Interface) modules that could be loaded during UEFI Secure Boot.]]>