Patch Tuesday, October 2014
Microsoft's monthly security release, Tuesday, October 14, 2014. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 2 with public exploit code
- 7.8HighOct 15, 2014Microsoft Win32k Privilege escalationCVE-2014-4113Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation.Exploited87% likelyExploit codeExploit-DB · Metasploit
- 7.8HighOct 15, 2014Microsoft Windows Code / command injectionCVE-2014-4114A vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.Exploited82% likelyExploit codeExploit-DB · Metasploit
- 8.8HighOct 15, 2014Microsoft Internet Explorer Privilege escalationCVE-2014-4123Microsoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.Exploited47% likely
- 8.8HighOct 15, 2014Microsoft Windows Code / command injectionCVE-2014-4148A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.Exploited60% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.