Researchers Nab $28k in Microsoft Bug Bounty Program

As part of its first-ever bounty program, Microsoft has paid out $28,000 to a small group of researchers who identified and reported vulnerabilities in Internet Explorer 11. The IE 11 bounty program only ran for one month during the summer, but it attracted a number of submissions from well-known...

Metasploit Exploit Module for IE Zero-Day Vulnerability

It’s been 14 days since Microsoft issued an advisory and temporary mitigation for a zero-day vulnerability in Internet Explorer, one being actively exploited in the wild and called by some experts as severe a browser bug as you can have. Yet users have since had little more to shield them from...

Internet Explorer zero-day exploit used watering hole attacks to target Japanese users

Attackers exploiting a zero-day vulnerability CVE-2013-3893 in Microsoft's Internet Explorer browser and served them on compromised popular Japanese news websites. According to FireEye, at least three major Japanese media websites were compromised in watering hole attacks, dubbed Operation...

Internet Explorer zero-day exploit used watering hole attacks to target Japanese users

Attackers exploiting a zero-day vulnerability CVE-2013-3893 in Microsoft’s Internet Explorer browser and served them on compromised popular Japanese news websites. According to FireEye, at least three major Japanese media websites were compromised in watering hole attacks, dubbed Operation...

Microsoft IE MSHTML内存破坏远程代码执行漏洞(CVE-2013-3893)

No description provided by source...

Microsoft Warns of New IE Zero Day

UPDATE–Microsoft is looking into reports of targeted attacks against a new vulnerability that exists in all supported versions of Internet Explorer. The attacks are targeting IE 8 and 9 and there’s no patch for the vulnerability right now, though Microsoft has developed a FixIt tool for it. “The...

CVE-2013-3893: Fix it workaround available

Today, we released a Fix it workaround tool to address a new IE vulnerability that had been actively exploited in extremely limited, targeted attacks. This Fix it makes a minor modification to mshtml.dll when it is loaded in memory to address the vulnerability. This Fix it workaround tool is link...

CVE-2013-3207

CVE-2013-3207 affects Microsoft Internet Explorer 9 and 10. The vulnerability is a memory corruption issue that could allow remote code execution via a crafted web site. Microsoft released MS13-069 (Cumulative Security Update for Internet Explorer, MS13-069; patch ID 2870699) to fix it. Affected ...

CVE-2013-3202

CVE-2013-3202 affects Microsoft Internet Explorer 10. The vulnerability is a memory corruption issue that allows remote code execution when a user visits a crafted website. Connected advisories confirm IE memory-corruption vectors and reference MS13-069 as the cumulative security update for Inter...

September's Patch Tuesday updates to fix Critical flaws in Windows, IE and Office

This Tuesday, Microsoft will be releasing its September's Patch Tuesday updates includes 14 bulletins in total, fixing issues in Windows, Office, Outlook, Internet Explorer, SharePoint and FrontPage. In all, there are eight remote code execution flaws in Microsoft Office, Microsoft Server Softwar...

Office, SharePoint Patches Await September Patch Tuesday

Today’s monthly advance notification of Microsoft’s upcoming security bulletin release on Tuesday includes a number of critical Office patches that have experts worried. Of particular concern are remote code execution vulnerabilities in Outlook 2007 and 2010 that can be exploited by merely...

Microsoft Windows Uniscribe字体解析远程代码执行漏洞(CVE-2013-3181)(MS13-060)

BUGTRAQ ID: 61697 CVECAN ID: CVE-2013-3181 Uniscribe是微软公司开发的Windows操作系统为正确演示Unicode文字而开发的组件。系统的核心是一个名为USP10.DLL的DLL。 受影响Microsoft Windows版本处理OpenType字体时，Unicode Scripts Processor存在远程代码执行漏洞，成功利用此漏洞造成内存破坏，攻击者以当前用户权限执行任意代码。 0 Microsoft Windows XP Professional Microsoft Windows XP Home Edition...

Jumping Out of IE's Sandbox With One Click

Software vendors often give intentionally vague and boring names to the updates they use to fix security vulnerabilities. The lamer the name, the less attention it may attract from attackers looking to reverse-engineer the patch. There was one patch in Microsoft’s August Patch Tuesday release...

CVE-2013-3189

CVE-2013-3189 affects Microsoft Internet Explorer 8 and 9. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site, described as memory corruption in IE, distinct from CVE-2013-3188. Connected sources corroborate impact as remote cod...

CVE-2013-3188

CVE-2013-3188 affects Microsoft Internet Explorer 8 and 9. The vulnerability allows remote code execution via a crafted web site due to memory corruption, enabling an attacker to run arbitrary code. The entry is coordinated with CVE-2013-3189 and is associated with MS13-059 (patch/mitigation). Af...

CVE-2013-3194

CVE-2013-3194 affects Microsoft Internet Explorer 9, describing a remote code execution/memory corruption vulnerability when a user views a crafted web page. The root cause is memory corruption in IE’s rendering components (MSHTML/related HTML DLLs) used by IE9, enabling arbitrary code execution ...

CVE-2013-3190

CVE-2013-3190 affects Microsoft Internet Explorer 8–10. The public description and connected records show remote code execution and memory corruption via a crafted Web page, impacting IE on Windows platforms of that era (notably IE8–10 on Windows XP/Vista/Server 2003/2008 variants). The vulnerabi...

Microsoft to Pay First Bug Bounty for IE 11

Just a few weeks after announcing its first bug bounty programs, Microsoft is already set to pay out a reward to a researcher from Google who discovered a vulnerability in Internet Explorer 11. Microsoft officials say that they have several other qualifying entries for the IE 11 reward program...

Attackers Targeting MS13-055 IE Vulnerability

Attackers are using an Internet Explorer vulnerability, which Microsoft patched yesterday, in targeted attacks that also employ a malicious Flash file installed through a drive-by download launched by compromised Web pages. The exploit that’s being used is capable of bypassing both ASLR and DEP...

CVE-2013-3164

CVE-2013-3164 : Vulnerability in Internet Explorer 8 where a use-after-free in CAnchorElement during memory handling can be abused by a crafted webpage to achieve remote code execution or memory corruption. Documented as MS13-055 (Cumulative Security Update for Internet Explorer, 2846071). Affect...