Microsoft Update Tuesday: April 2014, two final XP and Office 2003 fixes
Summary: Microsoft's final Update Tuesday before Windows XP and Office 2003 reach end-of-life shipped four bulletins covering eleven CVEs, including two fixes that also apply to XP and two that also apply to Office 2003. MS14-017 addresses Word, including a 0-day (CVE-2014-1761) caused by an improperly checked "listoverridecount" value in an RTF "overridetable" structure that leads to type confusion and remote code execution, while MS14-018 covers six Internet Explorer CVEs, mostly use-after-free flaws, none publicly known.
What's compelling: These are the last patches XP and Office 2003 will receive, and one of them closes a 0-day in Word that Microsoft had only mitigated with a "Fix it" that disables RTF entirely - so any machine still on those platforms after this month carries CVE-2014-1761 and the rest with no further fixes coming.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2014-0315CVE-2014-1759CVE-2014-1761
- Related
- CVE-2014-1761: Microsoft Word Memory Corruption Vulnerability Known Exploited Vulnerabilities · Feb 15, 2022CVE-2014-1761, Oh did you mean CVE-2012-2539? Cyber Risks ·