Microsoft Update Tuesday: January 2014, fix for the XP/2003 0-day vulnerability

Summary: Microsoft's January 2014 Update Tuesday shipped 4 bulletins covering 6 CVEs, all rated important, with no Internet Explorer bulletin and no critical bulletins. MS14-002 fixes the Windows XP/2003 kernel privilege escalation flaw (CVE-2013-5065) that was exploited in the wild alongside the Adobe Reader vulnerability CVE-2013-3346, where a crafted PDF gained code execution and then abused the NDProxy driver to gain system privileges.
What you should know: The XP/2003 flaw was already being exploited in tandem with a PDF-based Adobe Reader attack before the patch arrived, and Cisco Talos released rules SID 28867-28872 to cover it.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2013-3346 CVE-2013-5065 CVE-2014-0258 CVE-2014-0259 CVE-2014-0260 CVE-2014-0261 CVE-2014-0262
Related: Microsoft Update Tuesday: December 2013, some 0-day fixes Cyber Risks ·
CVE-2013-3346: Adobe Reader and Acrobat Memory Corruption Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022
CVE-2013-5065: Microsoft Windows Kernel Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022