(MS14-058) Vulnerabilities in Kernel-Mode Driver Could Allow Remote Code Execution (3000061)

Publish date: November 11, 2014

Severity: CRITICAL

CVE Identifier: CVE-2014-4113,CVE-2014-4148

Advisory Date: NOV 11, 2014

DESCRIPTION

This bulletin resolves two vulnerabilities in several Windows operating versions. The two vulnerabilities are related to TrueType Font Parsing and kernel-mode driver Win32k.sys. When successfully exploited, attackers can remotely execute code or elevate privilege on the affected computer.

SOLUTION

PATCH: https://technet.microsoft.com/library/security/ms14-058

AFFECTED SOFTWARE AND VERSION

Windows Server 2003 Service Pack 2
Windows Vista x64 Edition Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2
Windows 7 for 32-bit Systems Service Pack 1
Windows 7 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 R2 for Itanium-based Systems Service Pack 1
Windows 8 for 32-bit Systems
Windows 8 for x64-based Systems
Windows 8.1 for 32-bit Systems
Windows 8.1 for x64-based Systems
Windows Server 2012
Windows Server 2012 R2
Windows RT
Windows RT 8.1
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2 (Server Core installation)
Windows Server 2003 x64 Edition Service Pack 2
Windows Server 2003 with SP2 for Itanium-based Systems
Windows Vista Service Pack 2
Windows Server 2008 for 32-bit Systems Service Pack 2

Related Vulnerability

October 2014 - Microsoft Releases 8 Security Advisories

Related Malware

Featured Stories

View All

$hacker machine interface$
The State of SCADA HMI Vulnerabilities
A complete discussion of the different vulnerability categories, including case studies of vulnerable SCADA HMIs. The paper also provides a guide for vulnerability researchers, as well as vendors on quick and efficient bug discovery.
Read more
Rogue Robots: Testing the Limits of an Industrial Robot’s Security
The modern world relies heavily on industrial robots. But is the current robotics ecosystem secure enough to withstand a cyber attack?
Read more
$two years of pawn storm$
From Espionage to Cyber Propaganda: Pawn Storm's Activities over the Past Two Years
This paper takes a look at Pawn Storm's operations within the last two years, and how the group has expanded their activities from espionage to the use of cyber propaganda tactics.
Read more
$securing home routers$
Securing Your Routers Against Mirai and Other Home Network Attacks
Cybercriminals can turn unsecure home routers into slaves for their botnets or even abuse them to steal banking credentials. Know about your router’s hidden weaknesses and the many ways you can defend your homes and businesses against these threats.
Read more