Skip to main content
MSRC

2011

May 2011 Security Bulletin Release

Tuesday, May 10, 2011

Hello everyone, Pete Voss here again, and as I previously mentioned in the Advanced Notification on Thursday, today we are releasing two bulletins to help protect customers. The bulletins address a Critical vulnerability in Microsoft Windows and two Important vulnerabilities in Microsoft Office. MS11-035 is the sole Critical bulletin this month, and we recommend customers prioritize this bulletin.

Exploitability Index Improvements & Advance Notification Service for May 2011 Bulletin Release

Thursday, May 05, 2011

Hello everyone, Today we are announcing changes to Microsoft’s Exploitability Index. Since October 2008, we have used the Exploitability Index to provide customers with valuable exploitability analysis for our security bulletins, and starting Tuesday this information will become even more comprehensive for those who use Microsoft’s latest platforms. The Exploitability Index assesses the likelihood of functional exploit code being developed for a particular vulnerability.

Exploitability Index Improvements Now Offer Additional Guidance

Thursday, May 05, 2011

Exploitability Index Improvements Now Offer Additional Guidance In October of 2008, Microsoft published its first Exploitability Index: a rating system that helps customers identify the likelihood that a specific vulnerability would be exploited within the first 30 days after bulletin release. As of this month, we are making some changes to the rating system to make vulnerability assessment more clear and digestible for customers.

Coordinated Vulnerability Disclosure Reloaded

Tuesday, April 19, 2011

Today on the MSRC Blog, Matt Thomlinson announced three new efforts to provide more transparency into Microsoft’s vulnerability disclosure process. These included a Coordinated Vulnerability Disclosure (CVD) at Microsoft procedures document, the first release of MSVR Advisories on vulnerabilities that were discovered by Microsoft and fixed by affected vendors, and an internal employee disclosure policy.