Microsoft Update Tuesday November 2014: Fixes for 3 0-day Vulnerabilities

Summary: Microsoft released 14 security bulletins covering 33 CVEs, after postponing two announced bulletins (MS14-068 and MS14-075) due to issues that emerged in late testing. Four bulletins are critical, covering 21 CVEs that can result in remote code execution, including MS14-064, which fixes two OLE vulnerabilities (CVE-2014-6332 and CVE-2014-6352) both seeing attack in the wild, with CVE-2014-6352 stemming from an insufficient fix for CVE-2014-4114, the vulnerability exploited by Sandworm.
Key Takeaway: Two of this month's fixes address OLE flaws already under active attack, and one of them is a failed patch for the same vulnerability Sandworm used - a reminder that a fix can ship and still leave the door open.

Read the original at Cisco Talos ↗

Topics: Zero-Days & Exploits
Mentions: CVE-2014-4076 CVE-2014-4077 CVE-2014-4078 CVE-2014-4114 CVE-2014-4116 CVE-2014-4118 CVE-2014-4149 CVE-2014-6318 CVE-2014-6321 CVE-2014-6322 CVE-2014-6331 CVE-2014-6332 CVE-2014-6333 CVE-2014-6334 CVE-2014-6335 CVE-2014-6352
Related: Weaponized Powerpoint in the Wild Cyber Risks ·
Evilgrab Delivered by Watering Hole Attack on President of Myanmar’s Website Cyber Risks ·
CVE-2014-4077: Microsoft IME Japanese Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 25, 2022