Microsoft Patch Tuesday for April 2015: 11 Bulletins Released

Summary: Microsoft released 11 security bulletins in April 2015 addressing 26 CVEs, with the first four rated Critical covering Internet Explorer, Office, IIS, and the Graphics Component, and the remaining seven rated Important covering SharePoint, Task Scheduler, Windows, XML Core Services, Active Directory, .NET, and Hyper-V. MS15-033 addresses five Office vulnerabilities including CVE-2015-1641, which has been publicly disclosed and is currently being exploited, while MS15-034 covers CVE-2015-1635, a remote code execution flaw in the HTTP protocol stack in HTTP.sys caused by improperly parsing a crafted HTTP request.
What's compelling: One of the 26 CVEs, CVE-2015-1641 in Microsoft Office, is already publicly disclosed and being exploited in the wild, so patching it is not a theoretical exercise. The IIS flaw in HTTP.sys can be triggered by a single malformed HTTP request sent to a vulnerable server, putting internet-facing systems in the path of remote code execution.

Read the original at Cisco Talos ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2015-0098 CVE-2015-1635 CVE-2015-1639 CVE-2015-1640 CVE-2015-1641 CVE-2015-1643 CVE-2015-1644 CVE-2015-1645 CVE-2015-1649 CVE-2015-1650 CVE-2015-1651 CVE-2015-1653
Related: CVE-2015-1635: Microsoft HTTP.sys Remote Code Execution Vulnerability Known Exploited Vulnerabilities · Feb 10, 2022
CVE-2015-1641: Microsoft Office Memory Corruption Vulnerability Known Exploited Vulnerabilities · Nov 03, 2021
DragonOK Updates Toolset and Targets Multiple Geographic Regions Cyber Risks ·