Microsoft fixes CSS exploit in Patch Tuesday update

Microsoft on Tuesday issued three 'critical' security bulletins as part of its monthly Patch Tuesday programme.

Together with nine other alerts, which the company rated as 'important', the bulletins address 22 vulnerabilities spanning Microsoft products from Windows and Internet Explorer to Office and Internet Information Services.

On the top of the list is MS11-003, which is a cumulative update for Internet Explorer that resolves four vulnerabilities. It includes a fix for the nasty CSS bug outlined in Security Advisory 2488013, which could give attackers control of people's computers.

In a podcast (MP3) about the patches, Jerry Bryant, the group manager of response communications for Microsoft's Trustworthy Computing Group, downplayed the scope of the CSS issue, saying that the company had seen only limited, targeted attacks focused on this vulnerability. To drive that point home, the company has released telemetry of how that vulnerability stacks up against an already-patched vulnerability in the Windows Shell, to explain why a fix was not made available outside the company's normal release cycle.

For more on this ZDNet UK-selected story, see Microsoft patches Windows, IE on CNET News.