CVE-2014-0301
published 2014-03-12CVE-2014-0301: Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2…
PriorityP357critical9.3CVSS 2.0
AVNACMAuNCCICAC
EPSS
13.97%
96.1th percentile
Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability."
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Talos
Micorosft Update Tuesday: March 2014, all about IE (including two 0-day fixes)
blogs_talos·2014-03-11·CVSS 9.3
CVE-2014-0322 [CRITICAL] Micorosft Update Tuesday: March 2014, all about IE (including two 0-day fixes)
It's Microsoft Update Tuesday. While this month is relatively minor, a total of 5 bulletins, it is pretty large for the requisite Internet Explorer bulletin. There’s a total of 23 CVEs covered by the bulletins, 18 of which are found in IE.
There’s 2 critical and 3 important bulletins this month:
MS14-012 is the first critical bulletin and is the IE bulletin. Most of the vulnerabilities are, as usual, the result of "use-after-free" vulnerabilities. One of the vulnerabilities, CVE-2014-0322, was known publicly before the update and saw targeted attacks since February 14th. The temporary workaround in security advisory 2934088 that has been available from Microsoft since February 19th is now being replaced by a more formal fix. The vulnerability was being exploited in a watering hole attack
Talos
Micorosft Update Tuesday: March 2014, all about IE (including two 0-day fixes)
blogs_talos·2014-03-11·CVSS 9.3
[CRITICAL] Micorosft Update Tuesday: March 2014, all about IE (including two 0-day fixes)
## Micorosft Update Tuesday: March 2014, all about IE (including two 0-day fixes)
It's Microsoft Update Tuesday. While this month is relatively minor, a total of 5 bulletins, it is pretty large for the requisite Internet Explorer bulletin. There’s a total of 23 CVEs covered by the bulletins, 18 of which are found in IE.
There’s 2 critical and 3 important bulletins this month:
MS14-012 is the first critical bulletin and is the IE bulletin. Most of the vulnerabilities are, as usual, the result of "use-after-free" vulnerabilities. One of the vulnerabilities, CVE-2014-0322 , was known publicly before the update and saw targeted attacks since February 14 th . The temporary workaround in security advisory 2934088 that has been available from Microsoft since February 19 th is now being replace
2014-03-12
Published