Microsoft marked Valentine's Day with the release of seven patches - two critical and five important - as part of its regular monthly "Patch Tuesday" update cycle. The most serious security vulnerabilities involve flaws in Internet Explorer and Windows Media Player.

The IE patch (MS06-004) covers a cumulative update of security fixes. The (more noteworthy) Windows Media Player flaw (http://secunia.com/advisories/18835) creates a route for a malicious bitmap file (BMP) to inject malign code on vulnerable systems. It's similar in type to the Windows WMF flaw that became the subject of a large number of Trojan attacks in late December. But the latest vulnerability is harder to exploit and is not currently the subject of any hacker action. Nonetheless, Media Player versions 7.1 through 10 all need patching.

Microsoft's security bulletin, which gives a full run down of all seven flaws, can be found here (http://www.microsoft.com/technet/security/bulletin/ms06-feb.mspx). ®

Related stories

MS patch glitch cripples HP computers (18 April 2006)
http://www.channelregister.co.uk/2006/04/18/ms_patch_glitch/
Patches released for zero-day IE threat (29 March 2006)
http://www.channelregister.co.uk/2006/03/29/ie_patches_released/
eEye issues workaround against unpatched IE flaw (28 March 2006)
http://www.channelregister.co.uk/2006/03/28/eeye_ie_workaround/
MS issues Office überpatch (15 March 2006)
http://www.channelregister.co.uk/2006/03/15/ms_march_patch_tuesday/
MS avoids Oz PC time shift catastrophe (21 February 2006)
http://www.theregister.co.uk/2006/02/21/time_patch/
UK.gov repels zero day WMF attack (24 January 2006)
http://www.channelregister.co.uk/2006/01/24/uk_gov_wmf_attack/
More cracks appear in Windows (11 January 2006)
http://www.channelregister.co.uk/2006/01/11/ms_january_patch_tuesday/
Windows users waiting for serious fix (3 January 2006)
http://www.channelregister.co.uk/2006/01/03/windows_meta_file_hack/
MS releases IE überpatch (14 December 2005)
http://www.channelregister.co.uk/2005/12/14/ie_uberpatch/