Unscheduled fixes released for critical flaw in optional Windows codec
Company uses Microsoft Store to fix remote code-execution bugs in codecs library. …
reader comments
114 with 74 posters participating, including story author
Microsoft has published unscheduled fixes for two vulnerabilities, one of them with a severity rating of critical, that make it possible for attackers to execute malicious code on computers running any version of Windows 10.
Unlike the vast majority of Windows patches, the ones released on Tuesday were delivered through the Microsoft Store. The normal channel for operating System security fixes is Windows Update. Advisories here and here said users need not take any action to automatically receive and install the fixes.
“Affected customers will be automatically updated by Microsoft Store. Customers do not need to take any action to receive the update,” both advisories said. “Alternatively, customers who want to receive the update immediately can check for updates with the Microsoft Store App; more information on this process can be found here.”
When I checked both the Microsoft Store and the Windows Update on my Windows 10 laptop, however, I saw no confirmation that the patch had been installed. Normally, Windows 10 users can use the Windows Update tab within the Update and Security settings section to ensure patches have been installed. The link provided in the advisories offered no clarity. Microsoft representatives didn’t immediately respond to questions for clarification.
In a message received after this post went live, the person who discovered the vulnerabilities, Abdul-Aziz Hariri of Trend Micro’s Zero Day Initiative, confirmed theories several Ars readers have made in comments. They posited that that the update involved HEVC codecs, which are used in a Windows extension available from the Microsoft
Continue reading – Article source
