Where is the Microsoft fix for state-sponsored Windows attack threat?

Reports are coming in thick and fast about 'state-sponsored' zero-day exploits hitting business websites in the UK. The latest, disclosed yesterday by SophosLabs, involves an as yet unnamed European aeronautical parts supplier and follows on from another the day before involving a European medical company site. In both cases the same unpatched vulnerability in Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 that can allow remote code execution, as detailed in Microsoft Security Advisory 2719615 appears to have been successfully exploited. Read this to discover where to find the official Microsoft fix for this, and how to apply it.