Microsoft · Internet Explorer
CVE-2014-1776
Microsoft Internet Explorer Memory Corruption Vulnerability
Qué es
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via vectors related to the CMarkup::IsConnectedToPrimaryMarkup function, as exploited in the wild in April 2014. NOTE: this issue originally emphasized VGX.DLL, but Microsoft clarified that "VGX.DLL does not contain the vulnerable code leveraged in this exploit. Disabling VGX.DLL is an exploit-specific workaround that provides an immediate, effective workaround to help block known attacks."
CISA: Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.
Qué hacer
Apply updates per vendor instructions.
Plazo para las agencias federales de EE. UU.: 28 de julio de 2022
- Añadida a la lista de CISA
- 28 de enero de 2022
- Publicada
- 27 de abril de 2014
- Gravedad
- Crítica 9,8 CVSS 3.1
- Probabilidad de ataques en los próximos 30 días (EPSS)
- 83% entre el 0,3% superior de todas las vulnerabilidades conocidas
- Debilidad
- CWE-416
- Más detalles
- NVD · CVE.org · CISA
Todas las referencias (10)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-021
- http://securitytracker.com/id?1030154
- http://www.osvdb.org/106311
- http://blogs.technet.com/b/srd/archive/2014/04/30/protection-strategies-for-the-security-advisory-2963983-ie-…
- http://secunia.com/advisories/57908
- http://www.signalsec.com/cve-2014-1776-ie-0day-analysis/
- http://www.fireeye.com/blog/uncategorized/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9…
- http://www.kb.cert.org/vuls/id/222929
- https://technet.microsoft.com/library/security/2963983
- http://www.securityfocus.com/bid/67075
Más fallos explotados de Microsoft
| Añadido | Vulnerabilidad | Producto | Gravedad | Prob. de ataque |
|---|---|---|---|---|
| 20 may 2026 | Use-After-Free | Internet Explorer | Alto 8,8 | 92% |
| 20 may 2026 | Use-After-Free | Internet Explorer | Alto 8,8 | 82% |
| 6 oct 2025 | Uninitialized Memory Corruption | Internet Explorer | Alto 8,1 | 97% |
| 12 ago 2025 | Resource Management Errors | Internet Explorer | Alto 8,8 | 88% |
| 23 jul 2024 | Use-After-Free | Internet Explorer | Alto 8,8 | 79% |
| 30 mar 2023 | Memory Corruption | Internet Explorer | Alto 8,8 | 71% |
| 8 jun 2022 | Use-After-Free | Internet Explorer | Alto 8,1 | 80% |
| 25 may 2022 | Information Disclosure | Internet Explorer | Media 6,5 | 50% |
Fuentes: Known Exploited Vulnerabilities (CISA, dominio público), CVE records (cve.org) y EPSS (FIRST). La probabilidad de ataque es la estimación EPSS de que alguien intente explotar el fallo en los próximos 30 días.