Patch Tuesday, July 2015
Microsoft's monthly security release, Tuesday, July 14, 2015. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
4 CVEs · 0 critical · 4 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
4 CVEs · 0 critical · 4 exploited · 1 with public exploit code
- 8.8HighJul 14, 2015Microsoft Internet Explorer Memory corruptionCVE-2015-2419JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.Exploited53% likelyExploit codeExploit-DB
- 8.8HighJul 14, 2015Microsoft PowerPoint Memory corruptionCVE-2015-2424Microsoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.Exploited40% likely
- 8.8HighJul 14, 2015Microsoft Internet Explorer Memory corruptionCVE-2015-2425Microsoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).Exploited45% likely
- 7.8HighJul 14, 2015Microsoft ATM Font Driver Privilege escalationCVE-2015-2387ATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.Exploited35% likely
Adobe
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 7.8HighJul 14, 2015Adobe Flash Player Memory corruptionCVE-2015-5122Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).Exploited94% likelyExploit codeExploit-DB · Metasploit
- 7.8HighJul 14, 2015Adobe Flash Player Memory corruptionCVE-2015-5123Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player allows remote attackers to execute code or cause a denial-of-service (DoS).Exploited19% likely
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.