CVE-2014-0301: Double Free

Published Mar 12, 2014

Updated

Double free vulnerability in qedit.dll in DirectShow in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via a crafted JPEG image, aka "DirectShow Memory Corruption Vulnerability."

Affected Software

11 affected components

Microsoft Windows 7=sp1

Microsoft Windows 8

Microsoft Windows 8.1

Microsoft Windows Server 2003=sp2

Microsoft Windows Server 2008=sp2

Microsoft Windows Server 2008=r2-sp1

Microsoft Windows Server 2012

Microsoft Windows Server 2012=r2

Microsoft Windows Vista=sp2

Microsoft Windows XP=sp2

Microsoft Windows XP=sp3

Remediation

Patch Available

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-013

Event History

Mar 12, 2014

CVE Published

via MITRE·01:00 AM

Data Sourced

via MITRE·01:00 AM

Description

Data Sourced

via NVD·05:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0301?

CVE-2014-0301 has a severity rating of Important as it allows remote attackers to execute arbitrary code.

How do I fix CVE-2014-0301?

To fix CVE-2014-0301, apply the security update provided by Microsoft for your affected Windows version.

Which versions of Windows are affected by CVE-2014-0301?

CVE-2014-0301 affects Microsoft Windows XP SP2 and SP3, Windows Vista SP2, Windows 7 SP1, Windows 8, Windows 8.1, and various versions of Windows Server.

Can CVE-2014-0301 be exploited remotely?

Yes, CVE-2014-0301 can be exploited remotely, allowing attackers to execute arbitrary code on vulnerable systems.

What component contains the vulnerability in CVE-2014-0301?

The vulnerability in CVE-2014-0301 is located in the qedit.dll file within the DirectShow component of Windows.