Microsoft Faces Criticism Over Zero-Day Vulnerabilities and Patch Delays
TL;DR
Trend Micro's Zero Day Initiative (ZDI) criticized Microsoft for not crediting them in the disclosure and patching of a zero-day vulnerability in MSHTML, reported in May and patched in July. ZDI claims the flaw is a remote code execution vulnerability, contrary to Microsoft's classification as a spoofing vulnerability. This incident highlights broader issues in the coordinated vulnerability disclosure process, with vendors often failing to properly communicate and credit researchers.
Topics:technologycybersecurity#coordinated-vulnerability-disclosure#cybersecurity#internet-explorer#microsoft#trend-micro#zero-day-vulnerability
- ZDI shames Microsoft for – yet another – coordinated vulnerability disclosure snafu The Register
- Microsoft Windows Deadline—You Have 21 Days To Update Your PC Forbes
- Resurrecting Internet Explorer: Threat Actors Using Zero-day Tricks in Internet Shortcut File to Lure Victims (CVE-2024-38112) Check Point Research
- Attackers Have Been Leveraging Microsoft Zero-Day for 18 Months Dark Reading
- Microsoft July 2024 Patch Tuesday fixes 142 flaws, 4 zero-days BleepingComputer
Want the full story? Read the original reporting
Read on The Register