CVE-2015-1635

HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP requests, aka "HTTP.sys Remote Code Execution Vulnerability."

Published: Apr 14, 2015
Updated: Apr 13, 2023
CVE: CVE-2015-1635
Severity: High
Exploit:

CVSS v2:

Severity: High
Score: 10
AV:N/AC:L/Au:N/C:C/I:C/A:C

CWEs:

CWE-94

Affected Software
References

Software	From	Fixed in
microsoft / windows_server_2008	r2-sp1	r2-sp1.x
microsoft / windows_server_2012	r2	r2.x
microsoft / windows_7	--sp1	--sp1.x

http://packetstormsecurity.com/files/131463/Microsoft-Windows-HTTP.sys-Proof-Of-Concept.html
http://www.osvdb.org/120629
http://www.securityfocus.com/bid/74013
http://www.securitytracker.com/id/1032109
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-034
https://www.exploit-db.com/exploits/36773/
https://www.exploit-db.com/exploits/36776/

Vulnerability Database

289,571

CVE-2015-1635