Microsoft Update Tuesday May 2014: relatively light month

Summary: Microsoft's May 2014 Update Tuesday released eight bulletins covering 13 CVEs, split into two critical and six important bulletins, and was the first such release without XP updates aside from the out-of-band MS14-021 IE fix. The critical bulletins were MS14-022 for three SharePoint CVEs, including two remote code execution flaws requiring an authenticated user, and MS14-029 for two IE use-after-free CVEs, one of which (CVE-2014-1815) Microsoft said was under limited active attack.
What's compelling: MS14-025 addresses group policy preference XML files whose stored passwords are encrypted with a 32-byte key Microsoft has made publicly available, and the change does not apply to already-deployed policies, so administrators must update those manually. Separately, MS14-028's fix for iSCSI Target issues in Windows Storage Server will not be offered for Windows 2008, which Microsoft deemed too costly to rearchitect.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2014-1754 CVE-2014-1756 CVE-2014-1806 CVE-2014-1807 CVE-2014-1808 CVE-2014-1815
Related: Is It the Beginning of the End For Use-After-Free Exploitation? Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026