PT-2016-1166 · Microsoft · Windows Server 2012+4

Publicado 2016-02-09 · Atualizado 2019-05-15 · CVE-2016-0058

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10, and Windows Server 2012 Gold and R2

Description The issue is caused by a buffer overflow in the PDF Library component, allowing remote attackers to execute arbitrary code via a crafted PDF document that triggers API calls. This could enable an attacker to run arbitrary code on the user's system, potentially gaining the same user rights as the current user. The impact may be less severe for customers with fewer user rights on the system.

Recommendations For Microsoft Windows 8.1, apply the necessary patch to fix the buffer overflow issue in the PDF Library. For Windows Server 2012 Gold and R2, update the PDF Library component to prevent exploitation. For Windows 10, ensure the latest security updates are installed to address the vulnerability. As a temporary workaround, consider restricting the use of the PDF Library until a patch is available.

Correção

RCE

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

BDU:2016-00427

CVE-2016-0058

Produtos afetados

Windows

Mupdf Library

Windows 10

Windows 8.1

Windows Server 2012

Referências · 8

• https://osv.dev/vulnerability/CVE-2016-0058 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-00427 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-012 · Aviso do Fabricante
• http://securitytracker.com/id/1034973 · Nota
• http://technet.microsoft.com/security/bulletin/ms16-012 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-012 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0058 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-0058 · Nota de Segurança