September 2014 Microsoft Patch Tuesday security bulletins

The Operation SnowMan espionage campaign, which targeted military intelligence earlier this year via an Internet Explorer zero day, exposed a weak spot in Microsoft’s vulnerability management efforts. What was unique about the SnowMan operation is that it included a check as to whether the...

Linux Kernel < 2.6.20.2 - IPv6_Getsockopt_Sticky Memory Leak PoC

No description provided by source. / Linux Kernel IPV6GetsockoptSticky Memory Leak Proof Of Concept dreyer 07-2007 Osu, Tatakae, Sexy Pandas! Dumps to stdout the memory mapped between INI and END. CVE: CVE-2007-1000 BID: 22904 Affected: Linux Kernel 2.6.20.2...

Windows OpenType Font - File Format DoS Exploit

No description provided by source. OpenType font file format remote client-side DoS exploit for Windows By Oleksiuk Dmytro aka Cr4sh http://twitter.com/dolex http://blog.cr4.sh mailto:[email protected] INFO: Zero day vulnerability exists in kernel-mode library ATMFD.DLL, that using by OS for worki...

Microsoft Patches Internet Explorer Zero-Day Vulnerability, Even for Windows XP

Microsoft had publicized widely its plans to stop supporting oldest and widely used Operating system, Windows XP after 8th April this year, which means Microsoft would no longer issue security patches for XP. A few days back, we reported about a new critical Zero-day vulnerability in all versions...

New Internet Explorer Zero Day Used in Targeted Attacks

There’s a new zero-day vulnerability in many of the current versions of Internet Explorer and is being used in active attacks right now. The exploit that’s in use has the ability to bypass both DEP and ASLR and researchers say it’s being used by a known APT group. Microsoft has issued an advisory...

Microsoft Word Zero-Day Vulnerability is being exploited in the Wild

Microsoft warned about a zero-day vulnerability in Microsoft Word that is being actively exploited in targeted attacks and discovered by the Google security team. “At this time, we are aware of limited, targeted attacks directed at Microsoft Word 2010…” company said. According to Microsoft's...

IE Zero Day Exploits Increase Just Before Patch

Attackers have increased their exploitation of an Internet Explorer zero day vulnerability CVE-2014-0322 set to be fixed by Microsoft in its regularly scheduled patch Tuesday release later this afternoon. According to a Websense report, the exploit source code deployed in at least two incidents –...

Microsoft to Patch IE 10 Zero Day March 2014 Patch Tuesday

Microsoft will patch a lingering zero-day vulnerability in Internet Explorer next Tuesday, one of five bulletins it will release as part of its March 2014 Patch Tuesday security updates. The IE 10 zero-day was disclosed close to a month ago when researchers at FireEye reported on Operation SnowMa...

Adobe releases another Emergency Security Patch for Flash Player

Security Firm FireEye has uncovered yet another critical zero-day vulnerability in widely used Adobe Flash Software and Adobe has been forced to issue a second emergency patch update in less than a month. All versions of Adobe Flash Player released before today's patch are vulnerable to the...

Emergency Adobe Flash Update Handles Zero Day Under Attack

Adobe rushed out an unscheduled Flash Player update today to counter exploits of a zero-day vulnerability in the software. A number of national security, foreign policy and public policy websites are hosting exploits that redirect to espionage malware, including the Peter G. Peterson Institute fo...

Microsoft Ships IE 10 Zero Day Fix-It Tool

Microsoft last night released a Fix-It tool as a temporary mitigation for a zero-day vulnerability in Internet Explorer 10 being exploited by two hacker groups against the Veterans of Foreign Wars in the U.S. as well as a French aerospace manufacturer. IE 9 also contains the same use-after free...

Kaspersky Provides Details on Latest Adobe Flash Zero Day

Exploits for a newly reported zero-day vulnerability in Adobe’s Flash Player drop a password-grabbing Trojan that targets the email and social media accounts of users and organizations in China, researchers at Kaspersky Lab said today. The attacks appear to be an isolated campaign and there is no...

Microsoft to Patch Zero Day in January 2014 Security Updates

Microsoft announced Thursday that it plans to release four bulletins next week as part of the year’s first batch of Patch Tuesday security updates, none of which are rated critical. Despite the relatively light load, the patches do address a zero-day vulnerability in Windows XP and Windows Server...

USB Malware Targeting Siemens Control Software (Update C)

Overview VirusBlokAda, an antivirus vendor based in Belarus, announcedVirusBlokAda, http://www.anti-virus.by/en/tempo.shtml, website last visited July 15, 2010. the discovery of malware that uses a zero-day vulnerability in Microsoft Windows processing of shortcut files. The malware utilizes this...

Growing market of zero-day vulnerability exploits pose real threat to Cyber Security

NSS Labs issued the report titled "The Known Unknowns" to explain the dynamics behind the market of zero-day exploits. Last week I discussed about the necessity to define a model for "cyber conflict" to qualify the principal issues related to the use of cyber tools and cyber weapons in an...

Windows XP Zero Day Tied To Reader Flaw, Exploited in Wild

If your organization needed more incentive to move off Windows XP, a new zero-day vulnerability made public recently may be it. The bug, which is being exploited in the wild, allows local privilege escalation and kernel access. But in the bigger picture, it’s another indicator that attackers migh...

vBulletin Zero Day Used to Hack MacRumors, vBulletin

A hacker group calling itself Inj3ct0r is taking responsibility for the compromise of more than 860,000 passwords at MacRumors.com as well as a separate attack on vBulletin.com, makers of the vBulletin software powering a number of high-profile forums including MacRumors and Ubuntu Forums. The...

Internet Explorer zero-day vulnerability actively being exploited in the wild

Security researchers at FireEye have detected a new series of drive-by attacks based on a new Internet Explorer zero-day vulnerability. The attackers breached a website based in the US to deploy the exploit code to conduct a classic watering hole attack. The discovery was announced just a few day...

Microsoft set to deliver Patches for three Critical flaws, but no patch for Office Zero-day vulnerability

Microsoft has released advanced notification for the November 2013 security updates that are scheduled to be released on November 12, 2013. The company plans to deliver eight security bulletins for Windows 8.1, three of them are rated critical and five are important. But there's no relief in sigh...

CVE-2013-3906 : Zero Day Vulnerability in Microsoft Graphics Component

Microsoft has issued a temporary fix for a 0day vulnerability that can be exploited to install malware via infected Word documents. A Zero-day Remote code execution flaw, which has been dubbed CVE-2013-3906, exploits a vulnerability in a Microsoft graphics component, to target Microsoft Office...