After reports of a zero-day vulnerability exploiting IE8 for watering hole attacks, Microsoft confirmed the flaw and released Security Advisory 2847140. Microsoft Security Response Center wrote, “Internet Explorer 6, 7, 9 and 10 are not affected by the vulnerability.
Ms. Smith’s blog
The cloud-based note-syncing and productivity software service Evernote announced that attackers gained access to accounts’ usernames, email addresses and passwords, so 50 million Evernote customers are required to change their passwords.
Ms. Smith’s blog
Microsoft will be releasing an out-of-band patch tomorrow for the recently-disclosed zero-day hole in Internet Explorer. Find out if you need the patch, and start getting ready now. This one really is critical.
Naked Security – Sophos
There seems to have been no rest for Microsoft over the 2012 holidays as it issued a quick fix for a zero-day IE vulnerability that attackers were actively exploiting via drive-by download attacks. It may have felt like a flashback for the company as it also rushed to issue an emergency out-of-band update to deal with vulnerabilities in late December 2011.
Ms. Smith’s blog