CVE-2014-6329

CVE-2014-6329 : Affects Microsoft Internet Explorer 11. The vulnerability allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) by visiting a crafted web site. The description corresponds to a memory corruption issue, and the CVE is noted as distinct f...

CVE-2014-6368

Microsoft Internet Explorer 11 contains CVE-2014-6368, an ASLR bypass that lets remote attackers bypass address space layout randomization by luring a user to a crafted web page. Public exploits exist. The affected product is Internet Explorer 11; impact includes partial integrity compromise with...

CVE-2014-6373

CVE-2014-6373 is a remote memory-corruption vulnerability in Microsoft Internet Explorer 10 that allows arbitrary code execution via a crafted web site. Affected product: Internet Explorer 10. Root cause: memory corruption when processing certain web content. Impact per sources: remote code execu...

CVE-2014-6363

CVE-2014-6363 affects the Microsoft VBScript engine (versions 5.6–5.8) used with Internet Explorer and other products. The issue is a memory corruption vulnerability in VBScript CRegExp/engine handling that can allow remote code execution when a user visits a crafted web page. Exploitation is evi...

CVE-2014-6365

CVE-2014-6365 affects Microsoft Internet Explorer 8–11 and describes a vulnerability where an attacker can bypass the built-in XSS filter by crafting a specific attribute in an HTML element. The root cause is a XSS filter bypass in IE’s HTML parsing/attribute handling. The CVE entry notes this as...

CVE-2014-6376

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6327 and CVE-2014-6329...

CVE-2014-6374

Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."...

CVE-2014-6366

CVE-2014-6366 is an Internet Explorer memory-corruption vulnerability affecting IE 6 and 7 (and broader IE versions per related advisories) that allows remote code execution via a crafted webpage, potentially causing memory corruption and DoS. Public exploits exist for this vulnerability; the iss...

CVE-2014-6365

Microsoft Internet Explorer 8 through 11 allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document, aka "Internet Explorer XSS Filter Bypass Vulnerability," a different vulnerability than CVE-2014-6328...

CVE-2014-6375

CVE-2014-6375 concerns Microsoft Internet Explorer 8, where a crafted web page can trigger a memory corruption vulnerability that allows remote code execution or a denial of service. Public exploits exist, and the issue is associated with IE’s handling of certain objects during page rendering. Th...

CVE-2014-6368

Microsoft Internet Explorer 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."...

CVE-2014-6327

Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service memory corruption via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-6329 and CVE-2014-6376...

IE Removes SSL 3.0 Fallback Used in POODLE Attacks

Yesterday’s Internet Explorer security bulletin, in addition to patching 14 vulnerabilities, also affords Windows admins the ability to disable SSL 3.0 in IE 11 for Protected Mode sites. Doing so eliminates exposure to POODLE SSL attacks. Microsoft said the change is off by default for now, but...

Microsoft Internet Explorer Insert Command Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

Microsoft Internet Explorer CTreePos Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The vulnerability relates to how...

Microsoft Internet Explorer CInputElement Type Confusion Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Internet Explorer CSetTimeoutInfo Use-After-Free Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Internet Explorer RtfToForeign32 Out-Of-Bounds Indexing Remote Code Execution Vulnerabilit

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

Microsoft Internet Explorer Multiple Vulnerabilities (3008923)

This host is missing a critical security update according to Microsoft Bulletin MS14-080. SPDX-FileCopyrightText: 2014 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

December 2014 Updates

Today, as part of Update Tuesday, we released seven security updates – three rated Critical and four rated Important in severity, to address 24 unique Common Vulnerabilities and Exposures CVEs in Microsoft Windows, Internet Explorer IE, Office and Exchange. We encourage you to apply all of these...