Microsoft Pushes Emergency Patch for IE

Summary: Microsoft released an emergency update in August 2015 to fix a critical flaw in all supported versions of Internet Explorer, from IE7 to IE11, that lets an attacker own a system when a user merely browses to a malicious or hacked website. Qualys CTO Wolfgang Kandek said the vulnerability, CVE-2015-2502, is actively being exploited in the wild, with attack code hosted on a malicious webpage, and the advisory credits a Google employee with reporting it.
Key Takeaway: The patch applies to every Windows user whether or not they browse with IE, because IE components are invoked by applications such as Microsoft Office, so a single unpatched machine is exposed through software its owner may not connect to the browser at all.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2015-2502
Related: CVE-2015-2502: Microsoft Internet Explorer Memory Corruption Vulnerability Known Exploited Vulnerabilities · Apr 13, 2022
Microsoft Internet Explorer Out of Band Advisory Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026