Microsoft Security Bulletin MS12-077 – Critical

This security update resolves three privately reported vulnerabilities in Internet Explorer. The most severe vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 9 and Internet Explorer 10 on Windows clients including the Internet Explorer 10 Release Preview for Windows 7 and Windows Server 2008 R2, and Moderate for Internet Explorer 9 and Internet Explorer 10 on Windows servers. This security update has no severity rating for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8, because the known attack vectors for the vulnerability discussed in this bulletin are blocked in a default configuration. However, as a defense-in-depth measure, Microsoft recommends that customers of this software apply this security update. For more information please see the full bulletin.

Microsoft Security Advisory (2755801) Update for Vulnerabilities in Adobe Flash Player in Internet Explorer 10

Microsoft is also releasing an update for Adobe Flash Player in Internet Explorer 10 on all supported editions of Windows 8, Windows Server 2012, and Windows RT. The update addresses the vulnerabilities in Adobe Flash Player by updating the affected Adobe Flash libraries contained within Internet Explorer 10. For more information please see the full advisory.

Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

— Tyson Storey, Program Manager, Internet Explorer

Update to Alleged Information and Security Issue with Mouse Position Behavior

Over the last few days we’ve seen reports alleging abuse of a browser behavior regarding mouse position. Microsoft is working closely with other companies to address the concern of mouse position movement. From what we know now, the underlying issue has more to do with competition between analytics companies than consumer safety or privacy.

We are actively working to adjust this behavior in IE. There are similar capabilities available in other browsers. Analytics firms can expect to do viewpoint detection in IE similarly to how they do this in other browsers. We will update this blog with more information as it is available.

Online advertisers started a shift (link) “from a ‘served’ to a ‘viewable’ impression[s].” Many different analytics companies stepped up to compete in this space. That competition has had many public results, including lawsuits (link). One of the companies involved in this space is Spider.io, which recently reported an issue in IE involving mouse pointer information. Spider.io is an advertising analytics company. Their recent blog post, “There are two ways to measure ad viewability. There is only one right way,” makes their point of view very clear. Different analytics companies use different and equivalent methods to gather consumer information across different browsers on different devices.

The only reported active use of this behavior involves competitors to Spider.io providing analytics. The theoretical use of this behavior to compromise the safety or privacy of consumers is something Microsoft’s security team has discussed with researchers across the industry. We take these risks very seriously. Getting all the pieces to line up in order to take advantage of this behavior – serving an ad to a site that asks for a logon, the user using an on screen (or virtual) keyboard, knowing how that onscreen keyboard works – is hard to imagine. From investigating the specific behavior when mouse position data is visible outside the browser window, sites can view only the mouse state; they cannot view the actual content that the user is interacting with. From our conversations with security researchers across the industry, we see very little risk to consumers at this time. As we have stated previously, there are no reported cases of any consumer having their information compromised.  

—Dean Hachamovitch, Corporate Vice President, Internet Explorer

Update:
Since the time of our post – these additional security blogs provide a good and balanced overview with respect to this topic:Actionable Intelligence: The Mouse That Squeaked and Spider.io Warns of Massive IE Security Flaw; But is it Legit?

HTML 5.0 and Canvas 2D Reach Candidate Recommendation Status

Today marks an important milestone for Web development, as the W3C announced the publication of the Candidate Recommendation (CR) version of the HTML 5.0 and Canvas 2D specifications. The specifications are on track for finalization by 2014. We want to congratulate the W3C on this achievement and bringing these specifications forward.

Internet Explorer 10 already offers hardware-accelerated HTML 5.0 and Canvas 2D support allowing developers to build compelling, cross-browser Web applications with good performance. We look forward to working with the Web community to finalize interoperable specifications in a timely manner. At the same time, we are actively involved in defining the scope for HTML 5.1, which includes exciting multimedia and other features that will continue to advance Web experiences.

You can read more about the progress to-date with HTML 5.0 and Canvas 2.0 specification, the next steps toward reaching Final Recommendation status, and progress toward defining HTML 5.1.

-- Sandeep Singhal, Group Program Manager, Internet Explorer

Penguin Mark: Blazing Fast Holiday Fun

We don’t want the holiday season to pass without sharing another new HTML5 experience that makes the most of your PC hardware and the new touch capabilities in Windows 8.

Check out Penguin Mark and enjoy some GPU-powered holiday fun. This experience brings together hardware-accelerated HTML5 capabilities like canvas, CSS3 animations and transitions, audio, WOFF, power and performance APIs, and more. Be sure to turn your volume up for maximum entertainment. The faster your browser, the higher your Penguin Mark score goes.

Click to test your browser’s holiday spirit with Penguin Mark

With Windows 8, we delivered a whole new browserthat’s fast and fluid, and built for touch browsing. IE10 adds support for a broad range of developer capabilities, including new touch APIs, performance, HTML5, CSS3, JavaScript, and more. We continue to be amazed and delighted by what developers are building on HTML5 and excited to be part of it.

Thank you!

Your participation and feedback is an important part of how we build IE. Today we want to say thank you to everyone who browses the Web with Windows 8, is using IE9 or IE10 preview on Windows 7, runs the test drives, and shares your feedback with the IE team. We also want to thank the people and groups who make the standards process work, the broad community of Web developers, and enthusiastic consumers who work to move the Web forward.

From the entire IE team, we wish you a Happy Hardware-accelerated Holiday Season, and we look forward to another exciting year and more progress on the Web in 2013.

—Rob Mauceri, Group Program Manager, Internet Explorer

Microsoft Security Bulletin MS13-008 - Critical

Today, we are releasing an out-of-band security update to fully address the issue described in Security Advisory 2794220. While we have still seen only a limited number of customers affected by the issue, the potential exists that more customers could be affected in the future.

This security update resolves one publicly disclosed vulnerability in Internet Explorer versions 6, 7, and 8. The vulnerability could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows clients and Moderate for Internet Explorer 6, Internet Explorer 7, and Internet Explorer 8 on Windows servers. Internet Explorer 9 and Internet Explorer 10 are not affected. For more information, see the full bulletin.

Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

— Tyson Storey, Program Manager, Internet Explorer

IE 9.0.11 Available via Windows Update

Microsoft Security Bulletin MS12-071 - Critical

This security update resolves three privately reported vulnerabilities in Internet Explorer. The vulnerabilities could allow remote code execution if a user views a specially crafted Web page using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.

This security update is rated Critical for Internet Explorer 9 on Windows clients and Moderate for Internet Explorer 9 on Windows servers. For more information, see the full bulletin.

Recommendation. Most customers have automatic updating enabled and will not need to take any action because this security update will be downloaded and installed automatically. Customers who have not enabled automatic updating need to check for updates and install this update manually. For information about specific configuration options in automatic updating, see Microsoft Knowledge Base Article 294871.

For administrators and enterprise installations, or end users who want to install this security update manually, Microsoft recommends that customers apply the update immediately using update management software, or by checking for updates using the Microsoft Update service.

• Tyson Storey, Program Manager, Internet Explorer

BUILD 2012: 50 Performance Tricks to make your HTML5 Applications and Sites faster

Creating high performance Web applications is crucial for every Web developer, be it a Web site that runs on a standards based Web browser or a Windows Store App. Microsoft recently hosted the BUILD 2012 conference at the Microsoft campus in Redmond, WA. At this conference, I had the opportunity to share the Internet Explorer team’s favorite 50 performance tips to make HTML5 apps and sites faster. If you weren’t able to attend the conference, I recommend you check out the video.

These performance tips and tricks apply equally to Web sites that run on standards based Web browsers, and Windows Store Apps, which are also just the Web. There are six principals detailed in the talk that will help you improve the performance of your apps and sites today:

• Quickly respond to network requests
• Minimize bytes downloaded
• Efficiently structure markup
• Optimize media usage
• Write fast JavaScript
• Know what your application is doing

I hope you enjoy the talk.

— Jatinder Mann, Internet Explorer, Program Manager