CVE-2014-1770
published 2014-05-22CVE-2014-1770: Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that…
PriorityP266critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
34.77%
98.2th percentile
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code via crafted JavaScript code that interacts improperly with a CollectGarbage function call on a CMarkup object allocated by the CMarkup::CreateInitialMarkup function.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Talos
Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
blogs_talos·2014-06-10·CVSS 5.1
[MEDIUM] Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
## Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
Once again it’s time for Microsoft’s Update Tuesday and this time it’s almost all about Internet Explorer. We had a bit of a lull in the past months with respect to IE vulnerabilities, especially due to the out-of-band patch that Microsoft released last month, which delayed some of the regularly scheduled fixes. However, this month more than makes up for it: we have a total of seven advisories this month, fixing 66 vulnerabilities, 59 of which are in IE.
There are two advisories that are marked as critical:
The first critical bulletin is MS14-035 and is the IE bulletin that covers 59 total vulnerabilities. Of these 59 vulnerabilities, two are information disclosure issues: CVE-2014-1777 and CV
Talos
Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
blogs_talos·2014-06-10·CVSS 5.1
[MEDIUM] Microsoft Update Tuesday June 2014: Internet Explorer, Internet Explorer, Internet Explorer
Once again it’s time for Microsoft’s Update Tuesday and this time it’s almost all about Internet Explorer. We had a bit of a lull in the past months with respect to IE vulnerabilities, especially due to the out-of-band patch that Microsoft released last month, which delayed some of the regularly scheduled fixes. However, this month more than makes up for it: we have a total of seven advisories this month, fixing 66 vulnerabilities, 59 of which are in IE.
There are two advisories that are marked as critical:
The first critical bulletin is MS14-035 and is the IE bulletin that covers 59 total vulnerabilities. Of these 59 vulnerabilities, two are information disclosure issues: CVE-2014-1777 and CVE-2014-1771. The last vulnerability was publicly known and is a TLS renegotiation vulnerability
http://www.kb.cert.org/vuls/id/239151http://www.securityfocus.com/bid/67544http://www.securitytracker.com/id/1030266http://zerodayinitiative.com/advisories/ZDI-14-140/https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035https://www.corelan.be/index.php/2014/05/22/on-cve-2014-1770-zdi-14-140-internet-explorer-8-0day/http://www.kb.cert.org/vuls/id/239151http://www.securityfocus.com/bid/67544http://www.securitytracker.com/id/1030266http://zerodayinitiative.com/advisories/ZDI-14-140/https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-035https://www.corelan.be/index.php/2014/05/22/on-cve-2014-1770-zdi-14-140-internet-explorer-8-0day/
2014-05-22
Published