Today we released six security bulletins addressing 29 unique CVE’s. Two bulletins have a maximum severity rating of Critical, three have maximum severity Important, and one is Moderate. We hope that the table below helps you prioritize the deployment of the updates appropriately for your environment.
| Bulletin | Most likely attack vector | Max Bulletin Severity | Max exploit-ability | Likely first 30 days impact | Platform mitigations and key notes |
|---|---|---|---|---|---|
| MS14-037(Internet Explorer) | Victim browses to a malicious webpage. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | Addresses 23 remote code execution issues and one lower severity Security Feature Bypass vulnerability. |
| MS14-038(Windows Journal) | Victim opens malicious .JNT file or navigates with Explorer to a WebDAV share under attacker control where a malicious .JNT file is automatically rendered. | Critical | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS14-040(AFD.sys) | Attacker running code at low privilege runs exploit binary to elevate to SYSTEM. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS14-041(Sandbox escape via DirectShow) | Attacker running code at low integrity level runs exploit binary to elevate to context of logged-on user. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS14-039(Sandbox escape via on-screen keyboard) | Attacker running code at low integrity level runs exploit binary to elevate to context of logged-on user. | Important | 1 | Likely to see reliable exploits developed within next 30 days. | |
| MS14-042(Service Bus) | Attacker could cause Service Bus to stop responding to incoming AMQP messages. | Moderate | n/a | Lower severity issue unlikely to see significant attacker interest. | Windows Azure not affected. |
- Jonathan Ness, MSRC