Microsoft releases single patch for January

Microsoft released a single fix on Tuesday in the first of its 2010 monthly security updates.

The January 'Patch Tuesday' update addresses a flaw in a component of Windows and Windows Server which, if exploited, could allow an attacker to remotely execute code on the targeted system.

The company explained that the flaw lies within the Windows components that handle Embedded OpenType Font packages. Researchers found that by bundling attack code into a font package, an exploit could be performed to give the attacker control over the system.

While the vulnerable code is believed to be present in all supported versions of Windows, the targeted component is only accessible in Windows 2000. As such, the flaw is being categorized as a 'Critical' risk for Windows 2000 SP4 users, but is only regarded as a low-level risk for Windows XP, Vista, 7, Server 2003 and Server 2008.

Additionally, the company posted a warning to Windows XP users regarding the Adobe Flash Player 6 component. Microsoft is advising users to upgrade their copy of Flash Player from the version that is originally bundled with Windows XP in order to patch up recently-discovered vulnerabilities.