Patch Tuesday, November 2014
Microsoft's monthly security release, Tuesday, November 11, 2014. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 8.8HighNov 11, 2014Microsoft Windows Memory corruptionCVE-2014-6332OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.Exploited95% likelyExploit codeExploit-DB · MetasploitDetection
- 7.8HighNov 11, 2014Microsoft Input Method Editor (IME) Japanese Privilege escalationCVE-2014-4077Microsoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.Exploited55% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.