Microsoft published the following security bulletins:

- MS10-089 - Important: Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Allow Elevation of Privilege (2316074) - Version:1.0
- MS10-088 - Important: Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2293386) - Version:1.0
- MS10-087 - Critical: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2423930) - Version:1.0
- MS10-054 - Critical: Vulnerabilities in SMB Server Could Allow Remote Code Execution (982214) - Version:1.3



MS10-089 - Important: Vulnerabilities in Forefront Unified Access Gateway (UAG) Could Allow Elevation of Privilege (2316074) - Version:1.0

Severity Rating: Important - Revision Note: V1.0 (November 9, 2010): Bulletin published.

Summary: This security update resolves four privately reported vulnerabilities in Forefront Unified Access Gateway (UAG). The most severe of these vulnerabilities could allow elevation of privilege if a user visits an affected Web site using a specially crafted URL. However, an attacker would have no way to force users to visit such a Web site. Instead, an attacker would have to persuade users to visit the Web site, typically by getting them to click a link in an e-mail message or Instant Messenger message that takes users to the attacker's Web site.

Read more

MS10-088 - Important: Vulnerabilities in Microsoft PowerPoint Could Allow Remote Code Execution (2293386) - Version:1.0

Severity Rating: Important - Revision Note: V1.0 (November 9, 2010): Bulletin published.

Summary: This security update resolves two privately reported vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a specially crafted PowerPoint file. An attacker who successfully exploited any of these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Read more

MS10-087 - Critical: Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (2423930) - Version:1.0

Severity Rating: Critical - Revision Note: V1.0 (November 9, 2010): Bulletin published.

Summary: This security update resolves one publicly disclosed vulnerability and four privately reported vulnerabilities in Microsoft Office. The most severe vulnerability could allow remote code execution if a user opens or previews a specially crafted RTF e-mail message. An attacker who successfully exploited any of these vulnerabilities could gain the same user rights as the local user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

Read more

MS10-054 - Critical: Vulnerabilities in SMB Server Could Allow Remote Code Execution (982214) - Version:1.3

Severity Rating: Critical - Revision Note: V1.3 (November 9, 2010): Added an update FAQ to announce a detection change that corrects the replaced bulletin for supported editions of Windows Vista and Windows Server 2008. This is a detection change only. There were no changes to the security update files.

Summary: This security update resolves several privately reported vulnerabilities in Microsoft Windows. The most severe of these vulnerabilities could allow remote code execution if an attacker created a specially crafted SMB packet and sent the packet to an affected system. Firewall best practices and standard default firewall configurations can help protect networks from attacks originating outside the enterprise perimeter that would attempt to exploit these vulnerabilities.

Read more