CVE-2014-6363
published 2014-12-11CVE-2014-6363: vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute…
PriorityP261critical9.3CVSS 2.0
AVNACMAuNCCICAC
EXPLOIT
EPSS
28.44%
98.1th percentile
vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | internet_explorer | — | — |
| microsoft | vbscript | — | — |
| microsoft | vbscript | — | — |
| microsoft | vbscript | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Trigger condition: VBScript RegExp.Execute called with a pattern containing alternation and zero-or-more quantifier (e.g. 'A|()*?$') against a string of 0x11 or more repeated characters, causing >16 CMatch objects to be allocated and triggering use of uninitialized memory in error-handling cleanup path of CRegExp::Execute. ↗
- →Heap manipulation technique: attacker allocates msvcrt heap blocks of size 0x44 bytes (x86) by executing RegExp patterns with a calculated number of sub-match groups to control block size and content, then frees them before triggering the vulnerability to control uninitialized CMatchBlock memory. ↗
- →The exploit uses the string marker 'PWND' as the RegExp match anchor to control match offsets and thus heap block contents during heap feng-shui preparation. ↗
- →CMatchBlock structure size is 0x44 bytes on x86 and 0x88 bytes on x64; monitor for repeated msvcrt heap allocations of these exact sizes during VBScript RegExp execution as a sign of exploit heap preparation. ↗
- →Exploitation path goes through CRegExp::Execute in vbscript.dll; monitor for Internet Explorer or script host processes (CScript.exe, WScript.exe) calling into vbscript.dll CRegExp::Execute with subsequent access violations or heap corruption indicative of uninitialized pointer dereference. ↗
- ·Heap feng-shui via JavaScript/VBScript strings is NOT effective for this vulnerability because strings are allocated through OLEAUT32, while CMatchBlock structures are allocated through msvcrt (a separate heap). Standard string-based heap spray techniques will not manipulate the relevant heap. ↗
- ·The PoC exploit does not implement DEP or ASLR bypass; the 'shellcode' is only INT3 instructions. Real-world exploitation requires additional mitigations bypass on top of the heap manipulation primitive. ↗
- ·The vulnerability affects VBScript 5.6–5.8 as used in Internet Explorer 6–11, IIS (via ASP), CScript.exe, and WScript.exe. The attack surface is broader than just browser-based exploitation. ↗
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Talos
Microsoft Patch Tuesday for December 2014: Light Month, Some Changes
blogs_talos·2014-12-09·CVSS 5.0
[MEDIUM] Microsoft Patch Tuesday for December 2014: Light Month, Some Changes
## Microsoft Patch Tuesday for December 2014: Light Month, Some Changes
This post was authored by Yves Younan .
Today, Microsoft is releasing their final Update Tuesday of 2014. Last year, the end of year update was relatively large. This time, it’s relatively light with a total of seven bulletins, covering 24 CVEs. Three of those bulletins are rated critical and four are considered to be important. Microsoft has made a few changes to the way they report their bulletins. Microsoft has dropped the deployment priority (DP) rating, which was very much environment-specific and might not be all that useful for non-default installations. Instead, they are now providing an exploitability index (XI), which ranges from zero to three. With zero denoting active exploitation and three denoting that
Talos
Microsoft Patch Tuesday for December 2014: Light Month, Some Changes
blogs_talos·2014-12-09·CVSS 5.0
[MEDIUM] Microsoft Patch Tuesday for December 2014: Light Month, Some Changes
This post was authored by Yves Younan.
Today, Microsoft is releasing their final Update Tuesday of 2014. Last year, the end of year update was relatively large. This time, it’s relatively light with a total of seven bulletins, covering 24 CVEs. Three of those bulletins are rated critical and four are considered to be important. Microsoft has made a few changes to the way they report their bulletins. Microsoft has dropped the deployment priority (DP) rating, which was very much environment-specific and might not be all that useful for non-default installations. Instead, they are now providing an exploitability index (XI), which ranges from zero to three. With zero denoting active exploitation and three denoting that it’s unlikely that the vulnerability would be exploited. Another change is
Zscaler
Zscaler found Security Vulnerabilities in MS Exchange Server
blogs_zscaler·CVSS 4.3
[MEDIUM] Zscaler found Security Vulnerabilities in MS Exchange Server
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084https://www.exploit-db.com/exploits/40721/https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-084https://www.exploit-db.com/exploits/40721/https://www.verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1075
2014-12-11
Published