Microsoft Update Tuesday July 2014: light month, mostly Internet Explorer

Summary: Microsoft's July 2014 Update Tuesday shipped six bulletins covering 29 CVEs, two rated critical, three important and one moderate, with most flaws in Internet Explorer. The IE bulletin MS14-037 alone covers 24 CVEs, 23 of them memory corruption issues that could allow remote code execution, mostly use-after-free, while MS14-038 fixes a single Windows Journal flaw (CVE-2014-1824) exploitable by opening a crafted file.
What you should know: Three of the important bulletins close out privilege-escalation flaws disclosed at Pwn2Own, including the on-screen keyboard (CVE-2014-2781) and afd.sys driver issues, so the patch window matters for anyone who assumed those contest findings were already handled.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-1824 CVE-2014-2780 CVE-2014-2781 CVE-2014-2783 CVE-2014-2814
Related: Microsoft Update Tuesday August 2014: Media Center and Internet Explorer Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026