MS07-036, which patches three vulnerabilities, two of them judged critical and one of them a zero-day flaw already out in public, repairs bugs in Excel 2000, 2002, 2003 and 2007. Similar vulnerabilities in other Microsoft Office document formats, including those in Word and PowerPoint, have been used by attackers to slip malicious code into corporations. Some of these attacks have been so narrowly targeted that they're launched against just one user at one company.

What's interesting about this update, said a Symantec researcher in an e-mail, is that Microsoft got it wrong back in February when it downplayed the initial report of the Excel threat. Then, Symantec's DeepSight threat network analysts reported Excel 2003 was susceptible to a denial-of-service bug that, if exploited, could crash the program. Four months ago, Microsoft denied that the bugs were actually vulnerabilities.

"Microsoft has completed its investigation of new public reports of possible vulnerabilities in Microsoft Office 2003 and Microsoft Excel 2003 [and] has confirmed that these are not product vulnerabilities," a spokeswoman told Computerworld at the time. "They are issues that can cause the application to become unresponsive. Users can restart the application," she said.

"[Today's] bulletin includes a fix for a previously disclosed denial-of-service issue from February 2007 which is now billed as having the potential for remote code execution," noted Oliver Friedrichs, director of Symantec's security response group.

As Friedrichs pointed out, Microsoft characterized all three bugs patched by MS07-036 as having a "remote code execution" impact, meaning that hackers could inject their own malware into a PC after exploiting the Excel flaws.

The third critical update, MS07-040, plugs three holes in the .NET Framework, the primary Windows runtime environment called on by developers. Notably, all three vulnerabilities were previewed during a sneak peek at the Syscan '07 security conference last week in Singapore.

But the patches may be a ton of trouble to corporate IT managers, said Storms, because the .NET Framework is so widely used by corporate developers of in-house software. "Not only will [companies] have to run QA on the patches, they'll have to run QA on the code that runs on .NET," said Storms. The fixes in MS07-040 apply to all but Version 3.x of .NET Framework, adding additional complexity to in-enterprise application testing.

Of the remaining security updates, one fixes a flaw in Publisher 2007, another patches Internet Information Services 5.1 on Windows XP Professional SP2, and the third quashes a bug in Windows Vista's bundled firewall.