CVE-2015-1635

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."
Code Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Affected Products (NVD)
VendorProductVersion
microsoftwindows_7
-
microsoftwindows_8
-
microsoftwindows_8.1
-
microsoftwindows_server_2012
-
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
http://www.osvdb.org/120629
http://www.securityfocus.com/bid/74013
http://www.securitytracker.com/id/1032109
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034
https://www.exploit-db.com/exploits/36773/
https://www.exploit-db.com/exploits/36776/
http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
http://www.osvdb.org/120629
http://www.securityfocus.com/bid/74013
http://www.securitytracker.com/id/1032109
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034
https://www.exploit-db.com/exploits/36773/
https://www.exploit-db.com/exploits/36776/
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2015-1635