Microsoft Critical Security Bulletins Summary for November 2014
Date: 12 November 2014
The purpose of this advisory is to bring attention to the monthly Microsoft Security Bulletin Summary for November.
The summary covers 14 bulletins (4 Critical, 8 Important and 2 Moderate - NOTE: MS14-068 and MS14-075 will have a later release date), which addresses multiple vulnerabilities in Internet Explorer, Microsoft .NET Framework, Microsoft Office, Microsoft Server Software and Microsoft Windows.
*** Critical ***
Vulnerabilities in Windows OLE Could Allow Remote Code Execution (3011443)
Cumulative Security Update for Internet Explorer (3003057)
Vulnerability in Schannel Could Allow Remote Code Execution (2992611)
Vulnerability in XML Core Services Could Allow Remote Code Execution (2993958)
MS14-068 - Release date to be determined
*** Important ***
Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3009710)
Vulnerability in TCP/IP Could Allow Elevation of Privilege (2989935)
Vulnerability in Windows Audio Service Could Allow Elevation of Privilege (3005607)
Vulnerability in .NET Framework Could Allow Elevation of Privilege (3005210)
Vulnerability in Microsoft SharePoint Foundation Could Allow Elevation of Privilege (3000431)
Vulnerability in Remote Desktop Protocol Could Allow Security Feature Bypass (3003743)
MS14-075 - Release date to be determined
Vulnerability in Internet Information Services (IIS) Could Allow Security Feature Bypass (2982998)
Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3003381)
*** Moderate ***
Vulnerability in IME (Japanese) Could Allow Elevation of Privilege (3005210)
Vulnerability in Kernel Mode Driver Could Allow Denial of Service (3002885)
CCIRC recommends that system administrators test and deploy the vendor-released updates to affected applications accordingly.
Note to Readers
In support of Public Safety's mission to build a safe and resilient Canada, CCIRC's mandate is to help ensure the security and resilience of the vital non-federal government cyber systems that underpin Canada's national security, public safety and economic prosperity. As Canada's computer security incident response team, CCIRC is Canada's national coordination centre for the prevention and mitigation of, preparedness for, response to, and recovery from cyber incidents on non-federal government systems. It does this by providing authoritative advice and support, and coordinating information sharing and incident response.
Please note, CCIRC PGP key has recently been updated.
For general information, please contact Public Safety Canada's Public Affairs division at:
Telephone: 613-944-4875 or 1-800-830-3118
- Date modified: