Microsoft fixes 'critical' Office Word security flaw under active attack