Microsoft and Adobe issue pair of patches each

It's a light Patch Tuesday this month, with just two patches each from Microsoft and Adobe.

Microsoft issued one for a critical flaw affecting Outlook Express and Windows Mail, fixing a privately reported vulnerability that could give an attacker the same local rights as the user. The flaw affects versions of Windows 7, Vista, XP and Server 2008.

Microsoft's security communications manager Jerry Bryant claimed in a blog post that the firm does "not expect reliable exploit code to surface in the next 30 days."

However, security research firm Trend Micro noted in a blog post that "an exploit has already been reported targeting this vulnerability," so attacks could be on the way.

The second Microsoft patch addressed a flaw in the runtime for Visual Basic for Applications that was rated critical for the VBA SDK and third party applications, but downgraded to important for Windows-based instances, as they would require more user interaction for the flaw to be used.

"Users are thus strongly advised to update their systems as soon as possible, as these vulnerabilities can be used by cybercriminals to create worms and to instigate drive-by download malware attacks on their systems," noted Trend Micro blogger Danielle Veluz.

While those flaws were the only ones to be patched this month, they aren't the only security concerns for Microsoft users.

Alan Bentley, international vice president for security firm Lumension, noted that an existing SharePoint flaw hasn't yet been patched, with Microsoft directing users to a workaround.

"Other software is also affected this May Patch Tuesday," he said in a statement. "A new Safari vulnerability that impacts Windows remains un-patched and Proof of Concept Code (POC) is freely downloadable on the internet."

Adobe patches up

Adobe followed Microsoft's patching lead, issuing a pair of fixes of its own.

The first was a critical flaw in Adobe Shockwave Player, and the second an important vulnerability in ColdFusion.

Trend Micro's Veluz noted: "The former poses as more widespread than the latter with 18 separate vulnerabilities (most of which are "critical"). Though the vulnerabilities in the latter were not as critical, they have been noted to lead to cross-site scripting (XSS) and information disclosure."