Microsoft Update Tuesday: February 2014, huge fix for Internet Explorer

Summary: Microsoft's February 2014 Update Tuesday delivered fixes for 32 CVEs across seven bulletins, with the Internet Explorer bulletin MS14-010 alone covering 24 vulnerabilities, most of them use-after-free flaws. The remaining bulletins include critical fixes for a VBScript type confusion flaw (CVE-2014-0271), a Direct2D remote code execution issue triggered by a malicious SVG object (CVE-2014-0263), and a Forefront Protection 2010 flaw reached through a crafted email (CVE-2014-0294), plus important-rated fixes in .NET, XML Core Services, and the IPv6 TCP/IP stack.
Key Takeaway: The XML Core Services same-origin bypass (CVE-2014-0266) was already used alongside the IE watering-hole 0-day CVE-2013-3918 to read local files and pull the msvcrt.dll timestamp for a version-specific ROP chain, so this month's patch closes a link attackers had demonstrated they would chain.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2013-3918 CVE-2014-0253 CVE-2014-0254 CVE-2014-0257 CVE-2014-0263 CVE-2014-0266 CVE-2014-0267 CVE-2014-0271 CVE-2014-0294 CVE-2014-0295
Related: CVE-2013-3918: Microsoft Windows Out-of-Bounds Write Vulnerability Known Exploited Vulnerabilities · Oct 06, 2025
Microsoft Update Tuesday November 2013: HyperV vulnerability and fix for 0day Cyber Risks ·
Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026