Microsoft has published the “Microsoft Security Bulletin Advance Notification for June 2014” in which are released seven security Bulletins addressing different vulnerabilities in the company’s products.

The notification includes two critical Remote Code Execution vulnerabilities affecting the products Microsoft Windows, Internet Explorer, MS Office and Lync, the remaining flaw are classified as “Important”.

Microsoft announced that the update will be released this Tuesday, my readers remember that the critical vulnerability in the Internet Explored was disclosed in May and raised numerous controversy within the IT community. According many sources, Microsoft had kept hidden the flaw since October 2013, this means that in this period users were exposed to the cyber threats able to exploit the flaw in the popular browser.

The curious thing is that after six months of silence of Microsoft, probably attributable to a difficulty to fix the bug, the company has completed the development of a patch in just 3 weeks (more or less).

As suggested by Microsoft the critical Bulletins (ID 1 and ID2) must be immediately fixed, the first one will address a the Remote Code Execution vulnerability affecting all versions of Internet Explorer.

The vulnerability reported in the Bulletin 1 is considered the most critical vulnerability, all server versions of Windows are affected by this vulnerability, but with a low severity rate.

 As reported by Mitre the vulnerability CVE-2014-1770 in Microsoft Internet Explorer 8 “allows remote attackers to execute arbitrary code via crafted JavaScript code that interacts improperly with a CollectGarbage function call on a CMarkup object allocated by the CMarkup::CreateInitialMarkup function.”