Microsoft Releases Security Update

Microsoft has released a security update to address a critical vulnerability in Windows. Exploitation of this vulnerability may allow a remote attacker to take control of an affected system. US-CERT encourages users and administrators to review Microsoft Security Bulletin MS15-078 and apply the...

July 2015 Security Updates

Today we released security updates for Microsoft Windows, Microsoft Office, Microsoft SQL Server, and Internet Explorer. As a best practice, we encourage customers to apply security updates as soon as they are released. For more information about this month’s security updates and advisories visit...

MS15-069: Vulnerabilities in Windows could allow remote code execution: July 14, 2015

SummaryThis security update resolves vulnerabilities in Microsoft Windows. These vulnerabilities could allow remote code execution if an attacker first places a specially crafted dynamic link library DLL file in the target user’s current working directory. Then, the attacker convinces the user to...

MS15-051: Vulnerabilities in Windows kernel-mode drivers could allow information disclosure: May 12, 2015

Resolves vulnerabilities in Windows that could allow remote code execution if a user opens a specially crafted document or could allow elevation of privilege if an attacker logs on locally and runs arbitrary code in kernel mode.SummaryThis security update resolves vulnerabilities in Windows, the...

MS15-034: Vulnerability in HTTP.sys Could Allow Remote Code Execution (3042553)

The version of Windows running on the remote host is affected a vulnerability in the HTTP protocol stack HTTP.sys due to improperly parsing crafted HTTP requests. A remote attacker can exploit this to execute arbitrary code with System privileges. C Tenable Network Security, Inc...

Creaking Patch Tuesday's Viability Rests with Quality, Speed

Today is Patch Tuesday, the 11-year-old procession of security bulletins from Microsoft streamed out automatically to consumers of Windows Update, and pulled en masse by enterprise admins worldwide needing to test each for compatibility. This is how it’s been done since shortly after Bill Gates’...

Microsoft Windows Object Linking and Embedding (OLE) OleAut32 library SafeArrayRedim function vulnerable to remote code execution via Internet Explorer

Overview A vulnerability in Microsoft Windows OLE could allow remote code execution if a user views a specially-crafted web page in Internet Explorer. Description The Microsoft Windows OLE OleAut32.dll library provides the SafeArrayRedim function that allows resizing of SAFEARRAY objects in memor...

MS KB3009008: Vulnerability in SSL 3.0 Could Allow Information Disclosure (POODLE)

The remote host is missing one of the workarounds referenced in the Microsoft Security Advisory 3009008. If the client registry key workaround has not been applied, any client software installed on the remote host including IE is affected by an information disclosure vulnerability when using SSL...

Microsoft Word RTF Object Confusion

Added: 07/24/2014 CVE: CVE-2014-1761 BID: 66385 OSVDB: 104895 Background Microsoft Office Word is Microsoft's word processing software, released as a component of Microsoft Office suite. Problem A buffer overflow exists due to an error in processing RTF files. The flaw is triggered by supplying a...

Microsoft MSN HBE - TB Blind SQL Injection Vulnerability

Document Title: =============== Microsoft MSN HBE - TB Blind SQL Injection Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1282 Video: http://www.vulnerability-lab.com/getcontent.php?id=1183 View Video: https://www.youtube.com/watch?v=JvCgZ2aYas...

Ancient 'STONED' Virus Signatures found in Bitcoin Blockchain

If you are dealing in cryptocurrency Bitcoin and have Microsoft's Security Essentials MSE installed on your system, then you could be infected by a virus called "DOS/STONED" from the Bitcoin BlockChain. With a number of high-profile cases of fraud, theft, and technical incompetence against the...

MS KB2957151: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer

The remote host is missing KB2957151. It is, therefore, affected by multiple vulnerabilities : - An unspecified use-after-free vulnerability exists that could allow for the execution of arbitrary code. CVE-2014-0510 - An unspecified vulnerability exists that could be used to bypass the same origi...

Description of the update rollup of revoked noncompliant UEFI modules for systems that do not have the 2919355 update installed: May 13, 2014

None None...

Microsoft Identifies New Malware Dropping Sefnit Botnet

Plenty has been written about the Sefnit malware family and its favor with using Tor to mask communication, as well as the money it’s made for criminals via click-fraud schemes. Sefnit, however, has had a pair of accomplices that until recently were regarded as harmless programs by most security...

Out-of-Band Release to Address Microsoft Security Advisory 2963983

At approximately 10 a.m. PDT, we will release an out-of-band security update to address the issue affecting Internet Explorer IE that was first discussed in Security Advisory 2963983. This update is fully tested and ready for release for all affected versions of the browser. The majority of...

Microsoft Internet Explorer CMarkup use-after-free vulnerability

Overview Microsoft Internet Explorer contains a use-after-free vulnerability, which can allow a remote, unauthenticated attacker to execute arbitrary code on a vulnerable system. Description Microsoft Internet Explorer contains a use-after-free vulnerability. This can allow for arbitrary code...

Internet Explorer CMarkup Object Handling Use-after-free Vulnerability

Added: 04/17/2014 CVE: CVE-2014-0322 BID: 65551 OSVDB: 103354 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Microsoft Internet Explorer 9 and 10 contain a use-after-free vulnerability in the CMarkup component of the MSHTML...

Internet Explorer CMarkup Object Handling Use-after-free Vulnerability

Added: 04/17/2014 CVE: CVE-2014-0322 BID: 65551 OSVDB: 103354 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Microsoft Internet Explorer 9 and 10 contain a use-after-free vulnerability in the CMarkup component of the MSHTML...

Internet Explorer CMarkup Object Handling Use-after-free Vulnerability

Added: 04/17/2014 CVE: CVE-2014-0322 BID: 65551 OSVDB: 103354 Background Internet Explorer is an HTML web browser which comes by default on Microsoft operating systems. Problem Microsoft Internet Explorer 9 and 10 contain a use-after-free vulnerability in the CMarkup component of the MSHTML...

Microsoft Office file format converter memory corruption vulnerability

Overview The Microsoft Office file format converter contains a memory corruption vulnerability, which may allow a remote, unauthenticated attacker to execute arbitrary code with the privileges of the user. Description Microsoft Office file format converter is a component that converts legacy...