Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Microsoft Fixes Critical Vulnerabilities in Internet Explorer, Windows

Microsoft and Adobe released a set of patches today to fix critical vulnerabilities in their products.

Microsoft and Adobe released a set of patches today to fix critical vulnerabilities in their products.

In the case of Microsoft, the company released a total of nine security bulletins to patch 37 bugs. Included in that number are critical fixes for Internet Explorer and Windows. The Internet Explorer bulletin addresses a total of 26 vulnerabilities, including one that was publicly disclosed. The most severe of the issues can be exploited to allow remote code execution when a user views a specially-crafted webpage using IE.

“IT’s first priority should be the critical, cumulative update for IE,” blogged Russ Ernst, director of product management at Lumension. “MS14-051 includes 26 CVEs for all supported versions of the browser. All are privately disclosed with the exception of one, CVE-2014-2819, which was publicly disclosed just last week at Black Hat. It allows an attacker to bypass the application sandbox and elevate privilege but it must be combined with another remote code execution vulnerability to ultimately be successful.”

The second critical update is aimed at Windows.

“The vulnerability could allow remote code execution if a user opens a specially crafted Microsoft Office file that invokes Windows Media Center resources,” Microsoft explained in its bulletin summary. “An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.”

Outside of those two, Microsoft’s other bulletins were ‘important’, and impact Microsoft OneNote, SQL Server, Windows, Microsoft Server Software and the .NET framework.

In addition to the Microsoft updates, Adobe Systems released patches for Adobe Flash Player, Adobe Reader and Adobe Acrobat. While the Adobe Flash Player bugs are not known to be under attack, the company said it is aware of evidence of an exploit in the wild being used against Adobe Reader users on Windows in targeted attacks. According to Adobe, the Reader and Acrobat updates address a vulnerability that could enable an attacker to circumvent sandbox protection on the Windows platform. Users on Mac OS X are not affected. 

Update: A quote incorrectly stated the number of IE vulnerabilities fixed by MS14-051. It is 26.

Advertisement. Scroll to continue reading.
Written By

Marketing professional with a background in journalism and a focus on IT security.

Click to comment

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this event as we dive into threat hunting tools and frameworks, and explore value of threat intelligence data in the defender’s security stack.

Register

Learn how integrating BAS and Automated Penetration Testing empowers security teams to quickly identify and validate threats, enabling prompt response and remediation.

Register

People on the Move

After the passing of Amit Yoran, Tenable has appointed Steve Vintz and Mark Thurmond as co-CEOs.

Former Wiz executive Trish Cagliostro has joined Orchid Security as Chief Revenue Officer.

Transcend has named former UnitedHealth Group CISO Aimee Cardwell as CISO in Residence.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.