PT-2015-5748 · Microsoft · Xml Core Services+1

Ucha Gobejishvili · Publicado 2015-08-11 · Atualizado 2018-10-12 · CVE-2015-2440

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions 3.0 through 6.0

Description An information disclosure issue exists when Microsoft XML Core Services exposes memory addresses not intended for public disclosure. This could allow an attacker to bypass Address Space Layout Randomization (ASLR) and potentially read private data. The issue does not allow an attacker to execute code or elevate user rights directly but could be used to obtain information to further compromise the affected system.

Recommendations For Microsoft XML Core Services versions 3.0 through 6.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2015-2440

ZDI-15-381

Produtos afetados

Xml Core Services

Office

Referências · 8

• http://zerodayinitiative.com/advisories/ZDI-15-381 · Nota
• http://securityfocus.com/bid/76232 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-084 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2440 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-15-381 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-2440 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/ms15-084 · Nota
• http://securitytracker.com/id/1033241 · Nota