Gravité: : Élevé
  Date du conseil: 14 avril 2015

  Description

Microsoft addresses the following vulnerabilities in its April batch of patches for 2015:

  • (MS15-032) Cumulative Security Update for Internet Explorer (3038314) )
    Risk Rating: Critical

    This security update resolves vulnerabilities in Internet Explorer. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Internet Explorer. An attacker who successfully exploited these vulnerabilities could gain the same user rights as the current user.


  • (MS15-033) Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (3048019)
    Risk Rating: Critical

    This security update resolves vulnerabilities in Microsoft Office. The most severe of the vulnerabilities could allow remote code execution if a user opens a specially crafted Microsoft Office file. An attacker who successfully exploited the vulnerabilities could run arbitrary code in the context of the current user.


  • (MS15-034) Vulnerability in HTTP.sys Could Allow Remote Code Execution (3042553)
    Risk Rating: Critical

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker sends a specially crafted HTTP request to an affected Windows system.


  • (MS15-035) Vulnerability in Microsoft Graphics Component Could Allow Remote Code Execution (3046306)
    Risk Rating: Critical

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow remote code execution if an attacker successfully convinces a user to browse to a specially crafted website, open a specially crafted file, or browse to a working directory that contains a specially crafted Enhanced Metafile (EMF) image file.


  • (MS15-036) Vulnerabilities in Microsoft SharePoint Server Could Allow Elevation of Privilege (3052044)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Office server and productivity software. The vulnerabilities could allow elevation of privilege if an attacker sends a specially crafted request to an affected SharePoint server.


  • (MS15-037) Vulnerability in Windows Task Scheduler Could Allow Elevation of Privilege (3046269)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. An attacker who successfully exploited the vulnerability could leverage a known invalid task to cause Task Scheduler to run a specially crafted application in the context of the System account.


  • (MS15-038) Vulnerabilities in Microsoft Windows Could Allow Elevation of Privilege (3049576)
    Risk Rating: Important

    This security update resolves vulnerabilities in Microsoft Windows. The vulnerabilities could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application. To exploit these vulnerabilities, an attacker would first have to log on to the system.


  • (MS15-039) Vulnerability in XML Core Services Could Allow Security Feature Bypass (3046482)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow security feature bypass if a user clicks a specially crafted link.


  • (MS15-040) Vulnerability in Active Directory Federation Services Could Allow Information Disclosure (3045711)
    Risk Rating: Important

    This security update resolves a vulnerability in Active Directory Federation Services (AD FS). The vulnerability could allow information disclosure if a user leaves their browser open after logging off from an application and an attacker reopens the application in the browser immediately after the user has logged off.


  • (MS15-041) Vulnerability in .NET Framework Could Allow Information Disclosure (3048010)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft .NET Framework. The vulnerability could allow information disclosure if an attacker sends a specially crafted web request to an affected server that has custom error messages disabled.


  • (MS15-042) Vulnerability in Windows Hyper-V Could Allow Denial of Service (3047234)
    Risk Rating: Important

    This security update resolves a vulnerability in Microsoft Windows. The vulnerability could allow denial of service if an authenticated attacker runs a specially crafted application in a virtual machine (VM) session.

  Information Exposure Rating:

Trend Micro Deep Security shields networks through the following Deep Packet Inspection (DPI) rules. Trend Micro customers using the Vulnerability Protection product or OfficeScan with Intrusion Defense Firewall (IDF) plugin are also protected from attacks using these vulnerabilities.

MS Bulletin ID Vulnerability ID DPI Rule Number DPI Rule Name Release Date Vulnerability Protection and IDF Compatibility
MS15-032 CVE-2015-1652 1006439 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1652)/td> 14-Apr-15 YES
MS15-032 CVE-2015-1657 1006610 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1657) 14-Apr-15 YES
MS15-032 CVE-2015-1660 1006612 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1660) 14-Apr-15 YES
MS15-032 CVE-2015-1661 1006613 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1661) 14-Apr-15 YES
MS15-032 CVE-2015-1665 1006615 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1665) 14-Apr-15 YES
MS15-032 CVE-2015-1666 1006616 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1666) 14-Apr-15 YES
MS15-032 CVE-2015-1667 1006617 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1667) 14-Apr-15 YES
MS15-032 CVE-2015-1668 1006618 Microsoft Internet Explorer Memory Corruption Vulnerability (CVE-2015-1668) 14-Apr-15 YES
MS15-033 CVE-2015-1641 1006623 Microsoft Office Memory Corruption Vulnerability (CVE-2015-1641) 14-Apr-15 YES
MS15-033 CVE-2015-1641 1006623 Microsoft Office Memory Corruption Vulnerability (CVE-2015-1641) 14-Apr-15 YES
MS15-033 CVE-2015-1649 1006625 Microsoft Office Component Use After Free Vulnerability (CVE-2015-1649) 14-Apr-15 YES
MS15-033 CVE-2015-1650 1006626 Microsoft Office Component Use After Free Vulnerability (CVE-2015-1650) 14-Apr-15 YES
MS15-033 CVE-2015-1651 1006627 Microsoft Office Component Use After Free Vulnerability (CVE-2015-1651) 14-Apr-15 YES
MS15-034 CVE-2015-1635 1006620 Microsoft Windows HTTP.sys Remote Code Execution Vulnerability (CVE-2015-1635) 14-Apr-15 NO
MS15-035 CVE-2015-1645 1006619 Microsoft Windows EMF Processing Remote Code Execution Vulnerability (CVE-2015-1645) 14-Apr-15 YES
MS15-036 CVE-2015-1640 1000552 Generic Cross Site Scripting(XSS) Prevention 5-Jul-06 NO
MS15-036 CVE-2015-1653 1000552 Generic Cross Site Scripting(XSS) Prevention 5-Jul-06 NO
MS15-039 CVE-2015-1646 1006628 MSXML Same Origin Policy Security Bypass Vulnerability (CVE-2015-1646) 14-Apr-15 YES
MS15-041 CVE-2015-1648 1006629 Microsoft Windows ASP.NET Information Disclosure Vulnerability (CVE-2015-1648) 14-Apr-15 NO

  Solutions