Microsoft and Adobe released a set of patches today to fix critical vulnerabilities in their products.
In the case of Microsoft, the company released a total of nine security bulletins to patch 37 bugs. Included in that number are critical fixes for Internet Explorer and Windows. The Internet Explorer bulletin addresses a total of 26 vulnerabilities, including one that was publicly disclosed. The most severe of the issues can be exploited to allow remote code execution when a user views a specially-crafted webpage using IE.
“IT’s first priority should be the critical, cumulative update for IE,” blogged Russ Ernst, director of product management at Lumension. “MS14-051 includes 26 CVEs for all supported versions of the browser. All are privately disclosed with the exception of one, CVE-2014-2819, which was publicly disclosed just last week at Black Hat. It allows an attacker to bypass the application sandbox and elevate privilege but it must be combined with another remote code execution vulnerability to ultimately be successful.”
The second critical update is aimed at Windows.
“The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file that invokes Windows Media Center resources,” Microsoft explained in its bulletin summary. “An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.”
Outside of those two, Microsoft’s other bulletins were ‘important’, and impact Microsoft OneNote, SQL Server, Windows, Microsoft Server Software and the .NET framework.
In addition to the Microsoft updates, Adobe Systems released patches for Adobe Flash Player, Adobe Reader and Adobe Acrobat. While the Adobe Flash Player bugs are not known to be under attack, the company said it is aware of evidence of an exploit in the wild being used against Adobe Reader users on Windows in targeted attacks. According to Adobe, the Reader and Acrobat updates address a vulnerability that could enable an attacker to circumvent sandbox protection on the Windows platform. Users on Mac OS X are not affected.
Update: A quote incorrectly stated the number of IE vulnerabilities fixed by MS14-051. It is 26.
More from Brian Prince
- U.S. Healthcare Companies Hardest Hit by ‘Stegoloader’ Malware
- CryptoWall Ransomware Cost Victims More Than $18 Million Since April 2014: FBI
- New Adobe Flash Player Flaw Shares Similarities With Previous Vulnerability: Trend Micro
- Visibility Challenges Industrial Control System Security: Survey
- Adobe Flash Player Zero-Day Exploited in Attack Campaign
- Researchers Demonstrate Stealing Encryption Keys Via Radio
- Researchers Uncover Critical RubyGems Vulnerabilities
- NSA, GCHQ Linked to Efforts to Compromise Antivirus Vendors: Report
Latest News
- Consolidate Vendors and Products for Better Security
- Pharmaceutical Giant Eisai Takes Systems Offline Following Ransomware Attack
- Vulnerabilities in Honda eCommerce Platform Exposed Customer, Dealer Data
- North Korean Hackers Blamed for $35 Million Atomic Wallet Crypto Theft
- Cisco Patches Critical Vulnerability in Enterprise Collaboration Solutions
- Barracuda Urges Customers to Replace Hacked Email Security Appliances
- Android’s June 2023 Security Update Patches Exploited Arm GPU Vulnerability
- BBC, British Airways, Novia Scotia Among First Big-Name Victims in Global Supply-Chain Hack
