Microsoft today said it will ship nine security updates next week, two rated "critical," to patch Internet Explorer (IE), Windows, SharePoint Server, Office Web Apps and the company's anti-malware software in Windows 8 and RT.
One security expert put his money on the IE update as the most important of the pending, in part because he expects Microsoft to fix the flaws revealed a month ago at the Pwn2Own hacking contest.
"Microsoft will patch the vulnerability from Pwn2Own [in IE10]," said Andrew Storms, director of security operations at Tripwire. "It has to. If it doesn't, it would be no better off than it was before, when it patched IE every other month."
Storms was referring to the two vulnerabilities that a team from the French firm Vupen exploited at Pwn2Own. Vupen won $100,000 for demonstrating the exploit of IE10 on Windows 8 Pro running on a Surface Pro tablet.
The bugs, Vupen said four weeks ago, existed in both the desktop version of IE10 on Windows 8 as well as in the "Modern"-style browser that runs on the tile-based user-interface (UI) once dubbed "Metro."
Google and Mozilla patched the vulnerabilities disclosed in their Chrome and Firefox browsers within hours of the contest, but Microsoft has yet to issue a post-Pwn2Own fix for IE.
April's Patch Tuesday will be on par with Microsoft's releases in 2013, which have averaged nine each month thus far in the year. Last year, the monthly average was 6.9 updates, Storms said.
Two of the updates will be ranked critical, Microsoft's top threat rating, while the remaining seven will be tagged as "important," the next ranking below critical.
Like last month, the most notable was the one that will patch all supported versions of IE, including the 12-year-old IE6, IE7, IE8, IE9 and also the newest, IE10. "Bulletin 1," as the update was identified today in Microsoft's monthly advance warning of the upcoming updates, affects IE10 on Windows 7, Windows 8 and Windows RT.
It will be the first critical update to IE10 on Windows 7 since the new browser was launched on that operating system in late February.
Next week's IE patches will be the fourth month in a row that Microsoft has quashed bugs in its browser, and the ninth month out of the last 10 with an IE update. Last July, Microsoft announced it had beefed up the IE security and patching teams, and would be able to issue monthly updates rather than every other month, as had been its practice for years.
Also on next week's agenda will be a critical update to all client editions of Windows except for Windows 8 and Windows RT; those will be unaffected, Microsoft said.
Storms hesitated to speculate on the Windows update's focus, noting that there was simply not enough information to make an informed guess. "They haven't changed the format or amount of data in the advanced notification," Storms pointed out. "But to read the tea leaves, we'd have to try to pull out details that just aren't there yet."
None of the seven updates rated as important allow for "remote code execution," a phrase that indicates cybercriminals could exploit the vulnerability to hijack a PC. Instead, they're described by Microsoft as "elevation of privilege," "denial of service" or "information disclosure" bugs.
Some researchers were wary of the total update count. Alex Horan, a senior product manager at CORE Security was one. "I find the sheer volume of patches this month to be noteworthy," he said in an email. "Large numbers of updates lead to more administration and ultimately delays. This can allow critical vulnerabilities to be exploited while less significant concerns simply cloud the security picture."
Storms disagreed. "I'm not entirely concerned on the count," he said. "You have to look at the priorities and the ratings on how critical they are to decide if you need to deploy immediately."
Among the seven important updates are ones aimed at Windows Defender, the anti-malware tool bundled with Windows 8 and Windows RT; SharePoint Server, which was patched last month; and Office Web Apps 2010, the stripped-down, online apps for Excel, PowerPoint, Word and OneNote.
Although security experts, including Storms, have criticized Microsoft for providing too little information about updates to its Modern apps, Storms remained a supporter of the more-informative advance notifications for traditional software.
"There's still value here," he said. "We have the number of updates, what's affected, the criticalities. There's no Exchange update this month, for example, so the Exchange team can take the month off."
Microsoft will issue next week's slate of nine updates on April 9 around 1 p.m. ET.
Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer, on Google+ or subscribe to Gregg's RSS feed. His email address is gkeizer@computerworld.com.
See more by Gregg Keizer on Computerworld.com.
Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.