Microsoft Update Tuesday August 2014: Media Center and Internet Explorer

Summary: Microsoft's August 2014 Update Tuesday shipped six bulletins covering 29 CVEs, two rated critical, three important and one moderate, with the bulk in Internet Explorer. The IE bulletin MS14-037 accounts for 24 CVEs, 23 of them memory corruption issues that could allow remote code execution, most of them use-after-free flaws, while MS14-038 covers a single remote code execution flaw in Windows Journal triggered by opening a maliciously crafted file.
What's compelling: Three of the important bulletins close out escalation-of-privilege vulnerabilities disclosed at Pwn2Own, including flaws in the on-screen keyboard, the Ancillary Function Driver and DirectShow that let low-integrity applications gain higher privileges or escape their restrictions.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-1824 CVE-2014-2780 CVE-2014-2781 CVE-2014-2783 CVE-2014-2814
Related: Microsoft Update Tuesday July 2014: light month, mostly Internet Explorer Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026