The highest deployment priority for administrators should be MS14-010, a cumulative security update for Internet Explorer, and MS14-011, a vulnerability in VBScript Scripting Engine that could allow Remote Code Execution. MS14-010 addresses 25 vulnerabilities in Internet Explorer. Of these vulnerabilities, only one was publicly disclosed prior to today and none are known to be under active attack. The companion bulletin MS14-011 shares CVE-2014-0271 in common with MS14-010. When the Advance Notification was released last Thursday, Ernst was a bit surprised not to see an update for IE since the browser had not updated in January, either. But, it had been updated every month for at least a year prior to that. It’s possible Microsoft wanted to give some last-minute quality attention to the bulletin prior to release.
Microsoft was looking to deliver a light Patch Tuesday this month, but added two last-minute bulletins to the mix. February now includes seven bulletins, four critical and three important, that cover a total of 32 CVEs. The patches address vulnerabilities in Windows, Internet Explorer, Security Software and the .NET framework. Russ Ernst, director of product management at Lumension, takes a closer look at this February's Patch Tuesday.