Today we released seven security bulletins addressing 12 CVE’s. Five of the bulletins have a maximum severity rating of Critical, and two have a maximum severity rating of Important. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment.

Bulletin Most likely attack vector Max Bulletin Severity Max XI Likely first 30 days impact Platform mitigations and key notes
MS12-077

(Internet Explorer)

 Victim browses to a malicious webpage. Critical 1 Likely to see reliable exploits developed within next 30 days. Internet Explorer versions 6, 7, 8 offered this update only to block a defense-in-depth attack vector whereby an attacker could convince a victim to trigger a XSS vulnerability by copy-pasting JavaScript into the URL field.
MS12-079

(Word)

 Victim opens a malicious RTF file attachment or previews a rich text email in the Outlook preview pane with Word set as default viewer, resulting in potential code execution in the context of the logged-on user. Critical 1 Likely to see reliable exploits developed within next 30 days. Reading email in plaintext mitigates the potential Outlook Preview Pane attack vector.
MS12-081

(Windows File Handling)

 Victim navigates to a malicious WebDAV or SMB share and encounters a maliciously-crafted Unicode filename. Critical 1 Likely to see reliable exploits developed within next 30 days.  
MS12-078

(Windows font drivers - ATMFD & win32k.sys)

 Most likely attack vector is an attacker who is already running code on a machine leverages vulnerability to elevate from low-privileged account to SYSTEM. Critical 1 Likely to see an exploit released granting a local attacker SYSTEM level access. One of the two CVE’s usable for denial-of-service only. The other (CVE-2012-4786) could potentially be embedded in either an Office document or a PDF file.
MS12-080

(Oracle Outside In for Exchange)

 Attacker sends email with malicious attachment and lures victim to view the attachment as a webpage within Outlook Web Access. The attacker could potentially compromise the server-side process generating the web page. Critical 1 Likely to see reliable exploits developed within next 30 days. Oracle Outside In process runs at a lower privilege level, LocalService. For more background information, please see this SRD blog post.
MS12-082

(DirectPlay)

 Victim opens a malicious Office document having an embedded ActiveX control, resulting in potential code execution in the context of the logged-in user. Important 2  Will be difficult to build a reliable exploit for this vulnerability. Less likely to see consistently working exploit code in the next 30 days.  
MS12-083

(IP-HTTPS Security Feature Bypass)

 Attacker having a legitimately issued but hence revoked computer certificate able to establish a DirectAccess tunnel to gain access to a corporate Intranet. Important N/A Not Applicable - Security Feature bypass only with no direct code execution potential. This attack is only possible after attacker obtains a revoked computer certificate that is trusted by the IP-HTTPS server.

- Jonathan Ness, MSRC Engineering