Windows XP's final Patch Tuesday

Microsoft has released its final security fixes for Windows XP as part of its latest Patch Tuesday update. The latest set of releases is quite light, with just four patches issued, two labelled as 'critical' and two as 'important'. These cover key Microsoft products Windows, Office and Internet Explorer. The six fixes within the patch for Internet Explorer cover several versions of Windows, including Windows XP, and is one of the critical releases. The issues were spotted by researchers at firms including Trend Micro, HP and Palo Alto Networks. "These vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer," Microsoft said. "An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user." The other critical fix covers Microsoft Office and Word, and also relates to a remote code execution vulnerability. <more>

Heartbleed bug exposes passwords

Internet security experts are scrambling to assess the extent of the breach caused by a massive bug called Heartbleed in the OpenSSL technology that runs encryption for two-thirds of the web and went unnoticed for two years until last week. A newly discovered bug in software supposed to provide extra protection for thousands of the world's most popular websites has exposed highly sensitive information such as credit card numbers, usernames, and passwords, security researchers said. The discovery of the bug, known as Heartbleed, has caused several websites to advise their users to change their passwords. "This might be a good day to call in sick and take some time to change your passwords everywhere - especially your high-security services like email, file storage, and banking, which may have been compromised by this bug," Tumblr wrote in a note to its many users. "The little lock icon (HTTPS) we all trusted to keep our passwords, personal emails, and credit cards safe, was actually making all that private information accessible to anyone who knew about the exploit." Yahoo, the owner of Tumblr, confirms that its users' passwords have been compromised. The bug was discovered late last week in the OpenSSL technology that runs encryption for two-thirds of the Internet. <more>

Apple releases Safari 7.0.3 update for Mavericks

Apple on Tuesday patched the security vulnerability in Safari that was successfully exploited at last month's Pwn2Own hacking contest, where a team cracked the browser to win $65,000. The Cupertino, Calif. company seeded updates for both Safari 6 and Safari 7 yesterday, promoting the former to version 6.1.3 and the latter to 7.0.3. Safari 6.x runs on OS X 10.7, aka Lion, and OS X 10.8, better known as Mountain Lion. Safari 7.x runs on OS X 10.9, or Mavericks. Apple patched 27 vulnerabilities in Safari 6 and Safari 7, all in WebKit, the open-source browser engine that powers Safari, and all but one considered critical in that they could allow, the company said, "arbitrary code execution," Apple's terminology for the most serious bugs. <more>