Search...

MS13-002: Description of the security update for XML Core Services 4.0: January 8, 2013

2013-01-08T00:00:00
ID KB2758694
Type mskb
Reporter Microsoft
Modified 2013-01-17T19:45:37

Description

<html><body><p>Resolves a security vulnerability that exists in Microsoft XML Core Services that could allow arbitrary code to run when you view a specially crafted webpage by using Internet Explorer.</p><h2>INTRODUCTION</h2><div class="kb-summary-section section">Microsoft has released security bulletin MS13-002. To view the complete security bulletin, go to one of the following Microsoft websites: <ul class="sbody-free_list"><li>Home users:<div class="indent"><a href="http://www.microsoft.com/security/pc-security/bulletins/201301.aspx" id="kb-link-1" target="_self">http://www.microsoft.com/security/pc-security/bulletins/201301.aspx</a></div><span class="text-base">Skip the details</span>: Download the updates for your home computer or laptop from the Microsoft Update website now:<br/><div class="indent"><a href="http://update.microsoft.com/microsoftupdate/" id="kb-link-2" target="_self">http://update.microsoft.com/microsoftupdate/</a></div></li><li>IT professionals:<div class="indent"><a href="http://technet.microsoft.com/security/bulletin/ms13-002" id="kb-link-3" target="_self">http://technet.microsoft.com/security/bulletin/MS13-002</a></div></li></ul><h3 class="sbody-h3">How to obtain help and support for this security update</h3> Help installing updates: <a href="https://support.microsoft.com/ph/6527" id="kb-link-4" target="_self">Support for Microsoft Update</a><br/><br/>Security solutions for IT professionals: <br/><a href="http://technet.microsoft.com/security/bb980617.aspx" id="kb-link-5" target="_self">TechNet Security Troubleshooting and Support</a><br/><br/>Help protect your Windows-based computer from viruses and malware: <a href="https://support.microsoft.com/contactus/cu_sc_virsec_master" id="kb-link-6" target="_self">Virus Solution and Security Center</a><br/><br/>Local support according to your country: <br/><a href="https://support.microsoft.com/common/international.aspx" id="kb-link-7" target="_self">International Support</a><br/><br/></div><h2></h2><div class="kb-moreinformation-section section"><h4 class="sbody-h4">Known issues with this security update</h4><ul class="sbody-free_list"><li>When you install this security update on a computer that is running Windows Vista or Windows Server 2008, you may have to restart the computer two times to complete the installation. This issue may occur if you install an XML Core Services 4.0–based update together with an update that contains inbox drivers. For example, the following updates contain inbox drivers:<div class="indent"><a href="https://support.microsoft.com/en-us/help/956697" id="kb-link-8">956697 </a> Windows Server 2008 Hyper-V VSS writer is not used during a backup job because of corrupted or invalid virtual machine configuration files<br/><br/><a href="https://support.microsoft.com/en-us/help/938371" id="kb-link-9">938371 </a> A software update is available for the Windows Vista installation components</div>This issue occurs because Microsoft Windows Installer (MSI)-based installations will not continue while inbox drivers are updating. This is because inbox drivers set the "impactful transaction" flag and the "reboot required" flag at the servicing stack level for Windows Vista and for Windows Server 2008. Therefore, the update for XML Core Services 4.0 will fail during installation if an update that contains an inbox driver is applied first. After the inbox driver is installed, and after the computer is restarted, the installation of security update for XML Core Services 4.0 will succeed. However, an additional restart is required to complete the installation.<br/><br/>To avoid this issue, install the security update for XML Core Services 4.0 before you install the update that contains inbox drivers.<br/><br/></li><li>Security update 2758694 does not support the complete removal of MSXML 4.0.<br/><br/>This situation occurs because this version of MSXML is installed in side-by-side mode. To work around this issue, follow these steps:<ol class="sbody-num_list"><li>Install update 973685. For more information about update 973685, click the following article number to view the article in the Microsoft Knowledge Base:<div class="indent"><a href="https://support.microsoft.com/en-us/help/973685" id="kb-link-10">973685 </a> Description of an update for Microsoft XML Core Services 4.0 Service Pack 3</div></li><li>Install this security update (2758694).</li><li>Remove security update 973685 by using the <span class="text-base">Add or Remove Programs</span> item in Control Panel.</li><li>Delete the Msxml4.dll file from the %SystemRoot%\System32 folder.</li><li>Repair the previous installation of MSXML 4.0 (from step 2) by using the <span class="text-base">Add or Remove Programs</span> item in Control Panel.</li></ol><br/><br/>The earlier versions of the Msxml4.dll file and of the Msxml4r.dll file are restored to the side-by-side folder and to the %SystemRoot%\System32 folder.</li></ul></div><h2></h2><div class="kb-moreinformation-section section"><h4 class="sbody-h4">Restart information</h4>You must restart the computer after you install this security update.</div><h2></h2><div class="kb-moreinformation-section section"><h4 class="sbody-h4">Security update replacement information</h4>This security update replaces the following security update:<div class="indent"><a href="https://support.microsoft.com/en-us/help/2721691" id="kb-link-12">2721691 </a> MS12-043: Description of the security update for XML Core Services 4.0: July 10, 2012</div></div><h2></h2><div class="kb-moreinformation-section section"><h4 class="sbody-h4">Removal information</h4>For Microsoft XML Core Services 4.0, this update does not support the complete removal of MSXML 4.0. For more information, please see the "Known issues with this security update" section. </div><h2></h2><div class="kb-summary-section section"><h4 class="sbody-h4">File information</h4>The English (United States) version of this security update has the file attributes (or later file attributes) that are listed in the following table. The dates and times for these files are listed in Coordinated Universal Time (UTC). When you view the file information, it is converted to local time. To find the difference between UTC and local time, use the <strong class="uiterm">Time Zone</strong> tab in the <strong class="uiterm">Date and Time</strong> item in Control Panel.<br/><div class="table-responsive"><table class="sbody-table table"><tr class="sbody-tr"><th class="sbody-th">File name</th><th class="sbody-th">File version</th><th class="sbody-th">File size</th><th class="sbody-th">Date</th><th class="sbody-th">Time</th><th class="sbody-th">Platform</th></tr><tr class="sbody-tr"><td class="sbody-td">Msxml4.dll</td><td class="sbody-td">4.30.2117.0</td><td class="sbody-td">1,402,312</td><td class="sbody-td">08-Nov-2012</td><td class="sbody-td">11:29</td><td class="sbody-td">Not Applicable</td></tr><tr class="sbody-tr"><td class="sbody-td">Msxml4r.dll</td><td class="sbody-td">4.30.2100.0</td><td class="sbody-td">88,904</td><td class="sbody-td">08-Nov-2012</td><td class="sbody-td">11:27</td><td class="sbody-td">Not Applicable</td></tr></table></div></div><h2></h2><div class="kb-notice-section section"><a class="bookmark" id="appliestoproducts"></a><br/><h3 class="sbody-h3">Applies to</h3>This article applies to the following:<ul class="sbody-free_list"><li>Microsoft XML Core Services 4.0 Service Pack 3 when used with:<ul class="sbody-free_list"><li>Windows 8</li><li>Windows Server 2012</li><li>Windows 7</li><li>Windows 7 Service Pack 1</li><li>Windows RT</li><li>Windows Server 2008 R2</li><li>Windows Server 2008 R2 Service Pack 1</li><li>Windows Server 2008 Service Pack 2</li><li>Windows Vista Service Pack 2</li><li>Windows Server 2008 Service Pack 2</li><li>Windows XP Service Pack 3</li><li>Windows XP Professional x64 Edition Service Pack 2</li><li>Windows Server 2003 Service Pack 2</li></ul></li></ul></div></body></html>

JSON Vulners Source
Initial Source


All product names, logos, and brands are property of their respective owners. All company, product and service names used in this website are for identification purposes only. Use of these names, logos, and brands does not imply endorsement.If you are an owner of some content and want it to be removed, please mail to content@vulners.com Vulners, 2018
Protected by