Microsoft Security Updates July 2015

CVE-2015-2387 is a privilege escalation flaw in ATMFD.DLL, the Adobe Type Manager Font Driver that ships with Microsoft Windows Server. A local attacker triggers it by running a crafted application that feeds malicious data to the font driver, causing code to execute outside the user's intended privilege level. Successful exploitation lets an attacker who already has a foothold elevate from ordinary user rights to higher system privileges, enabling full compromise of the host. Affected systems are Windows Server deployments containing the ATM font driver that lack the vendor fix; because the attack requires local code execution, exposure is primarily to hosts where users or processes can run code. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, confirming exploitation in the wild, and it carries a high EPSS of 35.1% (98th percentile); no public PoC is known and ransomware use is unconfirmed.

Do: Apply Microsoft updates per vendor instructions on all Windows Server systems, prioritizing legacy builds that may have missed the 2015-era font-driver patches, and verify the patched ATMFD.DLL on servers where users or applications can run code. Because exploitation requires local access, pair patching with restricting arbitrary local code execution and monitoring for post-compromise privilege escalation; federal agencies must remediate per the CISA KEV requirement.

CVE-2015-2419 is a memory corruption flaw (CWE-119) in the JScript engine used by Microsoft Internet Explorer, allowing remote attackers to execute arbitrary code or cause a denial of service through a crafted website. It is triggered when a user visits an attacker-controlled page whose JScript content corrupts memory in the affected browser process. A successful attacker gains remote code execution in the context of the logged-on user (or crashes the browser), which makes drive-by and exploit-kit delivery routes viable. Any Windows user running the affected versions of Internet Explorer at the time of disclosure was exposed, and Microsoft shipped fixes as part of its July 2015 security updates. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), carries a 53.4% EPSS (99th percentile), and related reporting places it among the top vulnerabilities used by exploit kits in 2015-2016.

Do: Apply Microsoft's July 2015 security updates for Internet Explorer per vendor instructions, as required by the CISA KEV catalog, and verify that any legacy Windows systems still running Internet Explorer have received them. Because exploitation typically occurs via drive-by web attacks, retire or fully patch IE on client endpoints and keep endpoint protection enabled to catch exploit-kit delivery. Confirm no workstations remain on unpatched IE builds, since this entry has been in CISA KEV since March 2022 and exploitation probability remains high (EPSS 53.4%).

CVE-2015-2424 is a memory corruption vulnerability (CWE-119) in Microsoft PowerPoint that can be exploited when the application processes a maliciously crafted Office document. An attacker must deliver the crafted file, typically via email or a downloaded document, and persuade a user to open it, at which point corrupted memory can result in arbitrary code execution or an application crash causing denial of service. Successful exploitation lets the attacker run code in the context of the current user, a common foothold for malware or ransomware delivery. Any user or organization running an unpatched, affected version of Microsoft PowerPoint is exposed; the source data does not specify exact version ranges, so defenders should follow vendor update guidance. Exploitation is confirmed: the flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2022-03-03, and a high EPSS score (38.5% probability of exploitation within 30 days, 98th percentile) signals elevated risk, although no public proof-of-concept is known and ransomware use is unconfirmed.

Do: Apply Microsoft's security updates for Office/PowerPoint across all endpoints per vendor instructions, prioritizing legacy and internet-reliant systems, since CISA's required action is to apply updates and specific fixed versions are not listed in this data. Reduce trigger exposure by scanning or sandboxing inbound Office attachments, keeping Protected View enabled, and monitoring for POWERPNT.EXE spawning unexpected child processes. Because the KEV listing confirms real-world exploitation, review endpoint logs for suspicious PowerPoint document-open activity or crashes.

Microsoft Internet Explorer contains a memory-corruption flaw (CWE-119) that a remote attacker can trigger when the browser processes crafted web content, resulting in remote code execution or a denial-of-service. A successful exploit would allow the attacker to run arbitrary code in the context of the logged-on user, potentially enabling malware installation or data theft. All deployments of Internet Explorer are potentially affected, although the source data does not specify exact version ranges. The flaw is confirmed exploited in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2022-05-25, and EPSS assigns a 44.9% probability of exploitation within 30 days (99th percentile), though no public PoC is known. CISA's ransomware association for this entry is unknown.

Do: Apply the Microsoft cumulative security update for Internet Explorer that addresses CVE-2015-2425, per vendor instructions, prioritizing internet-exposed and legacy Windows systems still using IE. Inventory which hosts still run Internet Explorer and which versions are present, and since IE reached end of support on June 15, 2022, migrate remaining users to Microsoft Edge (with IE mode for legacy web apps). Treat the KEV listing as justification for prompt prioritization even though no public PoC is available.