CVE-2014-0263: Buffer Overflow

Published Feb 12, 2014

Updated

The Direct2D implementation in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code via a large 2D geometric figure that is encountered with Internet Explorer, aka "Microsoft Graphics Component Memory Corruption Vulnerability."

Affected Software

8 affected components

Microsoft Windows 7=sp1

Microsoft Windows 8

Microsoft Windows 8.1

Microsoft Windows RT

Microsoft Windows RT 8.1

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-007

Event History

Feb 12, 2014

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Data Sourced

via NVD·04:50 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

Which systems and application path are affected?

Systems running the listed Windows versions are exposed when Internet Explorer encounters a large 2D geometric figure. The vulnerability can allow remote arbitrary-code execution.

What does an attacker need to exploit this issue?

The vector indicates network reachability, no authentication requirement, and medium attack complexity. Exploitation may compromise confidentiality, integrity, and availability.

What should teams do to remediate the vulnerability?

A patch is available. Apply the available patch to affected systems.