[Winvulns-announcements] BES Auto Notification: New Fixlets Published in Fixlet Site: 'Vulnerabilities to Windows Systems'

Wed Apr 29 05:21:39 PDT 2015

Fixlet Site - 'Vulnerabilities to Windows Systems'
Current Version: 441	Published: Tue, 28 Apr 2015 20:05:25  GMT

New Fixlets:
============

***************************************************************
Title: Microsoft office memory corruption vulnerability – CVE-2015-1641 (MS15-033)
Severity: High
Fixlet ID: 2787801
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval27878.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1641
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allow remote attackers to execute arbitrary code via a crafted RTF document, aka "Microsoft Office Memory Corruption Vulnerability."

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1652 (MS15-032)
Severity: High
Fixlet ID: 2789901
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval27899.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1652
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1666.

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1667 (MS15-032)
Severity: High
Fixlet ID: 2790801
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval27908.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1667
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

***************************************************************
Title: EMF processing remote code execution vulnerability - CVE-2015-1645 (MS15-035)
Severity: High
Fixlet ID: 2810101
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28101.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1645
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image, aka "EMF Processing Remote Code Execution Vulnerability."

***************************************************************
Title: ASP.NET information disclosure vulnerability - CVE-2015-1648 (MS15-041)
Severity: Low
Fixlet ID: 2811601
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28116.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1648
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: ASP.NET in Microsoft .NET Framework 1.1 SP1, 2.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2, when the customErrors configuration is disabled, allows remote attackers to obtain sensitive configuration-file information via a crafted request, aka "ASP.NET Information Disclosure Vulnerability."

***************************************************************
Title: Windows Hyper-V DoS vulnerability - CVE-2015-1647 (MS15-042)
Severity: Low
Fixlet ID: 2839701
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28397.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1647
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Virtual Machine Manager (VMM) in Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 allows guest OS users to cause a denial of service (VMM functionality loss) via a crafted application, aka "Windows Hyper-V DoS Vulnerability."

***************************************************************
Title: Microsoft SharePoint XSS vulnerability – CVE-2015-1653 (MS15-036)
Severity: Medium
Fixlet ID: 2852301
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28523.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1653
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Foundation 2013 SP1 and SharePoint Server 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."

***************************************************************
Title: Microsoft office component use after free vulnerability - CVE-2015-1650 (MS15-033)
Severity: High
Fixlet ID: 2856101
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28561.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1650
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2 and 2013 SP1, and Office Web Apps Server 2010 SP2 and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."

***************************************************************
Title: Microsoft SharePoint XSS vulnerability – CVE-2015-1640 (MS15-036)
Severity: Medium
Fixlet ID: 2856501
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28565.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1640
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Cross-site scripting (XSS) vulnerability in Microsoft Project Server 2010 SP2 and 2013 SP1 allows remote attackers to inject arbitrary web script or HTML via a crafted request, aka "Microsoft SharePoint XSS Vulnerability."

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1659 (MS15-032)
Severity: High
Fixlet ID: 2857401
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28574.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1659
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1662 and CVE-2015-1665.

***************************************************************
Title: Windows MS-DOS device name vulnerability - CVE-2015-1644 (MS15-038)
Severity: High
Fixlet ID: 2860301
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28603.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1644
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "Windows MS-DOS Device Name Vulnerability."

***************************************************************
Title: HTTP.sys Remote code execution vulnerability - CVE-2015-1635 (MS15-034)
Severity: High
Fixlet ID: 2862301
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28623.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1635
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

***************************************************************
Title: Microsoft office component use after free vulnerability - CVE-2015-1649 (MS15-033)
Severity: High
Fixlet ID: 2869001
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28690.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1649
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2, and Office Web Apps Server 2010 SP2 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1657 (MS15-032)
Severity: High
Fixlet ID: 2870401
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28704.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1657
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1665 (MS15-032)
Severity: High
Fixlet ID: 2870901
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28709.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1665
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1662.

***************************************************************
Title: Microsoft office component use after free vulnerability - CVE-2015-1651 (MS15-033)
Severity: High
Fixlet ID: 2875201
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28752.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1651
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Use-after-free vulnerability in Microsoft Word 2007 SP3, Word Viewer, and Office Compatibility Pack SP3 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Component Use After Free Vulnerability."

***************************************************************
Title: Active Directory Federation Services information disclosure vulnerability - CVE-2015-1638 (MS15-040)
Severity: Medium
Fixlet ID: 2878201
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28782.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1638
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Active Directory Federation Services (AD FS) 3.0 on Windows Server 2012 R2 does not properly handle logoff actions, which allows remote attackers to bypass intended access restrictions by leveraging an unattended workstation, aka "Active Directory Federation Services Information Disclosure Vulnerability."

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1662 (MS15-032)
Severity: High
Fixlet ID: 2878301
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28783.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1662
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1659 and CVE-2015-1665.

***************************************************************
Title: Internet Explorer ASLR bypass vulnerability - CVE-2015-1661 (MS15-032)
Severity: Medium
Fixlet ID: 2882101
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28821.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1661
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."

***************************************************************
Title: NtCreateTransactionManager type confusion vulnerability - CVE-2015-1643 (MS15-038)
Severity: High
Fixlet ID: 2883101
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28831.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1643
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Windows Server 2003 R2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 do not properly constrain impersonation levels, which allows local users to gain privileges via a crafted application, aka "NtCreateTransactionManager Type Confusion Vulnerability."

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1666 (MS15-032)
Severity: High
Fixlet ID: 2886101
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28861.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1666
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-1652.

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1660 (MS15-032)
Severity: High
Fixlet ID: 2886501
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28865.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1660
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."

***************************************************************
Title: Internet Explorer memory corruption vulnerability - CVE-2015-1668 (MS15-032)
Severity: High
Fixlet ID: 2889501
Fixlet Link: http://oval.mitre.org/oval/definitions/data/oval28895.html
Fixlet Link: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-1668
Fixlet Link: http://nvd.nist.gov/cvss.cfm?vectorinfo

Fixlet Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."