Patch Tuesday, April 2015

Microsoft's monthly security release, Tuesday, April 14, 2015. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

2 CVEs · 1 critical · 2 exploited · 2 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← March 2015 May 2015 →Open in the dashboard

Microsoft

2 CVEs · 1 critical · 2 exploited · 2 with public exploit code

9.8CriticalApr 14, 2015Microsoft HTTP.sys Code / command injectionCVE-2015-1635Microsoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.Exploited100% likelyExploit codeExploit-DB · Metasploit · NucleiDetection
7.8HighApr 14, 2015Microsoft Office Memory corruptionCVE-2015-1641Microsoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.Exploited97% likelyExploit codeDetection

Adobe

1 CVE · 0 critical · 1 exploited · 1 with public exploit code

7.8HighApr 14, 2015Adobe Flash Player Memory corruptionCVE-2015-3043A memory corruption vulnerability exists in Adobe Flash Player that allows an attacker to perform remote code execution.Exploited74% likelyExploit codeExploit-DB · Metasploit

SAP

No tracked SAP CVEs in this window.

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.