Microsoft Update Tuesday: Update for IE8 0-day and More
Summary: Microsoft's May 2013 Update Tuesday shipped fixes for 33 CVEs across 10 bulletins, including MS13-038 for a use-after-free 0-day (CVE-2013-1347) in IE8 that was used in a watering hole attack on a Department of Labor internal website targeting Department of Energy employees. The release also covered 11 other IE issues from IE6 to IE10, 11 Publisher remote code execution issues, Word and Visio fixes, a DirectX kernel double-fetch flaw (CVE-2013-1332) found with the bochspwn tool, and .NET, Lync, HTTP.sys and Windows Live Essentials updates.
What's compelling: The IE8 0-day was already used against Department of Energy employees, and Metasploit released an exploit for it early last week, so the window between patch and weaponized code had already closed before many organizations applied MS13-038.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2013-1332CVE-2013-1347
- Related
- CVE-2013-1347: Microsoft Internet Explorer Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Mar 03, 2022Continued analysis of the Lights Out Exploit Kit Cyber Risks ·Elderwood and the Department of Labor Hack Cyber Risks ·