Microsoft Patch Tuesday, July 2005: the CVEs

Microsoft Patch Tuesday July 2005: the CVEs Microsoft published on 12 July 2005, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Adobe, SAP. Earlier: Jun 2005, May 2005, Apr 2005, Mar 2005, Feb 2005, Jan 2005, Dec 2004, Nov 2004, Oct 2004, Sep 2004, Aug 2004, Jul 2004. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday

1. –CVE-2005-2226EPSS 13%2005-07-12

   Microsoft Outlook Express 6.0 leaks the default news server account when a user responds to a "watched" conversation thread, which could allow remote attackers to obtain sensitive information.

2. –CVE-2005-2225EPSS 16%2005-07-12

   Microsoft MSN Messenger allows remote attackers to cause a denial of service via a plaintext message containing the ".pif" string, which is interpreted as a malicious file extension and causes users to be kicked from a group conversation. …

3. –CVE-2005-2224EPSS 18%2005-07-12

   aspnet_wp.exe in Microsoft ASP.NET web services allows remote attackers to cause a denial of service (CPU consumption from infinite loop) via a crafted SOAP message to an RPC/Encoded method.

4. –CVE-2005-1219ExploitEPSS 50%2005-07-12

   Buffer overflow in the Microsoft Color Management Module for Windows allows remote attackers to execute arbitrary code via an image with crafted ICC profile format tags.

5. –CVE-2005-0564EPSS 26%2005-07-12

   Stack-based buffer overflow in Microsoft Word 2000 and Word 2002, and Microsoft Works Suites 2000 through 2004, might allow remote attackers to execute arbitrary code via a .doc file with long font information.