Microsoft Update Tuesday January 2015: Another Light Month, No IE Bulletins, More Changes to Reporting
Summary: Microsoft's first Update Tuesday of 2015 carried eight bulletins, each covering a single vulnerability, with seven rated important and one critical, and no Internet Explorer bulletin. One vulnerability was being actively exploited: CVE-2015-0016, a directory traversal issue in TS WebProxy rated XI zero, used to escape IE's sandbox and move a payload from low to medium integrity, while two others were publicly disclosed by Project Zero after its 90-day deadline passed.
What's compelling: The actively exploited flaw was chained with other vulnerabilities to break out of IE's sandbox, so patching it in isolation may not close the path an attacker already has in hand. Microsoft also stopped providing its Advance Notification Service to the general public, leaving non-premier customers without the pre-patch heads-up they previously used to plan deployment.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2015-0001CVE-2015-0002CVE-2015-0004CVE-2015-0006CVE-2015-0014CVE-2015-0015CVE-2015-0016
- Related
- CVE-2015-0016: Microsoft Windows TS Web Proxy Directory Traversal Vulnerability Known Exploited Vulnerabilities · May 25, 2022A Token’s Tale Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026