Microsoft, Adobe Push Critical Security Fixes

Summary: Adobe, Microsoft and Oracle each released updates on October 14, 2014, with Microsoft patching at least two-dozen Windows vulnerabilities and Oracle fixing at least 25 flaws in Java. One Microsoft update addresses CVE-2014-4114, a zero-day that iSight Partners said Russian hackers used in targeted email attacks against NATO, Ukrainian and Western government organizations and energy-sector firms.
Why it matters: The flaw being patched was already in use against NATO and Western government and energy targets, and it is present in every supported version of Windows - so the window between patch release and exploitation closes on the attacker's schedule, not yours.

Read the original at Krebs on Security ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-4114
Related: CVE-2014-4114: Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
Microsoft Update Tuesday October 2014: Fixes for 4 0-day Vulnerabilities Cyber Risks ·
Super Tuesday: A Patch Tuesday We Won’t Forget Cyber Risks ·