Microsoft Update Tuesday October 2014: Fixes for 4 0-day Vulnerabilities

Summary: Microsoft released eight bulletins in October 2014 covering 24 CVEs, three bulletins rated critical and five important, with four CVEs either publicly known or under active attack. Two of those four were being actively attacked: CVE-2014-4148, a TrueType font parsing flaw in Windows Kernel Mode Drivers that can run code when fonts are displayed on a webpage, and CVE-2014-4114, a Windows OLE vulnerability triggered when an Office document is opened in edit mode.
Key Takeaway: The OLE bug only fires in edit mode, so the default protected mode for Office files from untrusted locations is the control standing between an attacker and code execution. The IE bulletin alone carries 14 CVEs, one of them under limited attack, which is a large patch surface to close across an estate.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-4075 CVE-2014-4113 CVE-2014-4114 CVE-2014-4115 CVE-2014-4117 CVE-2014-4121 CVE-2014-4140 CVE-2014-4148 CVE-2014-4971
Related: Super Tuesday: A Patch Tuesday We Won’t Forget Cyber Risks ·
CVE-2014-4148: Microsoft Windows Remote Code Execution Vulnerability Known Exploited Vulnerabilities · May 25, 2022
CVE-2014-4113: Microsoft Win32k Privilege Escalation Vulnerability Known Exploited Vulnerabilities · May 04, 2022