Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote malicious users to execute arbitrary code via vectors involving crafted JavaScript code, CMarkup, and the onpropertychange attribute of a script element, as exploited in the wild in January and February 2014.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
microsoft internet explorer 9 |
||
microsoft internet explorer 10 |
Quihoo 360 plays the responsible disclosure game Windows 10 Spring Creators Update team explains the hold-up: You little BSOD!
Chinese company Quihoo 360 says it's found a Windows zero-day in the wild, but because it's notified Microsoft, it's not telling anyone else how it works. In this Weibo post (unless you speak Mandarin you'll need a translation tool), the company announced an “APT attack” on the unspecified zero-day “on a global scale”. It called the vulnerability a “double kill” bug, said it exploits “the latest version of Internet Explorer and applications that use the IE kernel”, and added that...
'Black Vine' gang, late of China, fingered as source of heist that lifted 70 million records
The case for a Beijing-orchestrated hack of health insurer Anthem has firmed up with new details suggesting that the sophisticated hacking group responsible for the heist shared zero days with rival outfits. Symantec has overnight dubbed the perps "Black Vine", suggesting the group was responsible for goring more than 70 million personal records from the US company in February. The security firm paints the group as ultra-sophisticated and unusually keen to share its precious trove of zero day vu...
Malware blizzard timed to coincide with snowstorms
Cyberspies have used an unpatched vulnerability in Internet Explorer 10 in an exploit which appears to target US military personnel. Among three high-priority updates in the most recent Patch Tuesday (11 February) was a cumulative fix for Explorer which addressed a whopping two dozen different memory corruption vulnerabilities in the web browser. However that very same day, net security firm FireEye identified a zero-day IE exploit (CVE-2014-0322) being served up from the US Veterans of Foreign...
Vulmon