Security Bulletin

RISK: Medium Risk

Microsoft Windows Kernel-Mode Drivers Elevation of Privilege Vulnerabilities

Win32k Memory Corruption VulnerabilityAn elevation of privilege vulnerability exists in the way that the Win32k.sys kernel-mode driver validates address values in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code with elevated privileges.Win32k Use After Free VulnerabilityAn elevation of privilege...

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3115 Views

RISK: Medium Risk

Microsoft Windows LRPC Client Buffer Overrun Vulnerability

An elevation of privilege vulnerability exists in Microsoft Local Remote Procedure Call (LRPC) where an attacker spoofs an LRPC Server and uses a specially crafted LPC port message to cause a stack-based buffer overflow condition on the LRPC client. LRPC internally uses Microsoft Local Procedure...

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3177 Views

RISK: Medium Risk

ASP.NET SignalR XSS Vulnerability

An elevation of privilege vulnerability exists in ASP.NET SignalR that could allow an attacker access to resources in the context of the targeted user.

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3466 Views

RISK: Medium Risk

Microsoft Office Token Hijacking Vulnerability

An information disclosure vulnerability exists when affected Microsoft Office software does not properly handle a specially crafted response while attempting to open an Office file hosted on the malicious website. An attacker who successfully exploited this vulnerability could ascertain access tokens used to authenticate the current user on a...

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3150 Views

RISK: High Risk

Microsoft Exchange Server Remote Code Execution Vulnerabilities

Oracle Outside In Contains Multiple Exploitable VulnerabilitiesTwo of the vulnerabilities addressed in this bulletin, CVE-2013-5763 and CVE-2013-5791, exist in Exchange Server 2007, Exchange Server 2010, and Exchange Server 2013 through the WebReady Document Viewing feature. The vulnerabilities...

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3279 Views

RISK: Medium Risk

Microsoft Office HXDS ASLR Vulnerability

A security feature bypass exists in an Office shared component that does not properly implement Address Space Layout Randomization (ASLR). The vulnerability could allow an attacker to bypass the ASLR security feature, after which the attacker could load additional malicious code in the process in an attempt...

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3167 Views

RISK: High Risk

Microsoft Internet Explorer Cumulative Security Update

Multiple Elevation of Privilege Vulnerabilities in Internet ExplorerElevation of privilege vulnerabilities exist within Internet Explorer during validation of local file installation and during secure creation of registry keys.Multiple Memory Corruption Vulnerabilities in Internet ExplorerRemote code execution vulnerabilities exist when Internet Explorer improperly accesses objects in memory. These...

Last Update Date: 13 Dec 2013 Release Date: 11 Dec 2013 3069 Views

RISK: High Risk

PHP OpenSSL Extension X.509 Certificate Parsing Memory Corruption Vulnerability

A vulnerability was reported in PHP. A remote user can execute arbitrary code on the target system. A remote user can send a specially crafted certificate to trigger a memory corruption flaw in openssl_x509_parse() and execute arbitrary code on the target system. The code will run...

Last Update Date: 12 Dec 2013 09:51 Release Date: 12 Dec 2013 3053 Views

RISK: High Risk

Mozilla Firefox / Thunderbird / SeaMonkey Multiple Vulnerabilities

Multiple vulnerabilities have been identified in Mozilla Firefox, Thunderbird and SeaMonkey, which be exploited by malicious people to disclose potentially sensitive information, conduct cross-site scripting attacks, bypass certain security restrictions, and compromise a user's system. Some unspecified errors exist, ...

Last Update Date: 11 Dec 2013 10:17 Release Date: 11 Dec 2013 3129 Views

RISK: Medium Risk

Adobe Shockwave Player Multiple Memory Corruption Vulnerabilities

Multiple vulnerabilities have been identified in Adobe Shockwave Player, which can be exploited by malicious people to compromise a user's system. Unspecified errors can be exploited to cause memory corruption. Successful exploitation of the vulnerabilities may allow execution of arbitrary code.

Last Update Date: 11 Dec 2013 10:00 Release Date: 11 Dec 2013 3030 Views