PT-2015-4436 · Microsoft · Windows

Publicado 2015-02-10 · Atualizado 2019-05-14 · CVE-2015-0061

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue arises from improper initialization of memory for TIFF images, allowing remote attackers to obtain sensitive information from process memory via a crafted image file. This is an information disclosure vulnerability that occurs when Windows fails to properly handle uninitialized memory when parsing certain, specially crafted TIFF image format files. An attacker who successfully exploits this could potentially read data not intended to be disclosed, which could be used to try to further compromise the affected system.

Recommendations For all affected versions, update to a version that properly initializes memory for TIFF images to prevent information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-0061

Produtos afetados

Windows

Referências · 8

• http://securitytracker.com/id/1031725 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100436 · Nota
• http://technet.microsoft.com/security/bulletin/ms15-016 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0061 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-0061 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-016 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100435 · Nota
• http://securityfocus.com/bid/72456 · Nota