Patch Tuesday for April 2014 - it's Goodbye, Farewell and Amen for Windows XP

The date's been in our diaries since 2007. But even with seven years to prepare for it, you'll be forgiven for approaching this month's Microsoft Patch Tuesday with a bit of a lump in your throat. It's the last paych for Windows XP, after 13 years of service, as well as the end of the road for Office 2003 and Exchange 2003, which won't get updates again. One burning question over the past two weeks is whether the recently-publicised Rich Text Format (RTF) zero-day in Microsoft Word would be patched.
That's a vulnerability that can theoretically be exploited on all versions of Word, even on the Mac, by using a booby-trapped RTF file that crashes Word and diverts control into executable code hidden inside the document file itself.
That's one of the worst sorts of security hole, known as an RCE. RCE is short for Remote Code Execution, and it generally means that an attacker can send you what is supposed to be a harmless data file, yet use it as a secret delivery mechanism for an executable warhead. The RTF zero-day is known as CVE-2014-1761, and can even affect you from Outlook.
If Outlook is configured to use Word to to render RTF files, previewing an RTF message could kick off an attack.
The good news is that Bulletin One of Microsoft's four patches for April 2014 will fix the RTF hole on all supported platforms, including Office 2003. That detali was confirmed on the Microsoft Security Response Center blog a few days ago.
Don't forget: if you're an Office for Mac user, the "all affected versions" mentioned above includes you, too.
 
Full Article