PT-2015-2016 · Microsoft · Windows Rt+8

Published 2015-09-09 · Updated 2019-05-14 · CVE-2015-2519

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to an integer overflow in Windows Journal, allowing remote attackers to execute arbitrary code via a crafted .jnt file. This can be exploited by a remote attacker using a specially formed JNT file, potentially leading to the execution of arbitrary code.

Recommendations For Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10, update to a version that includes the fix for the integer overflow in Windows Journal. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Integer Overflow

Weakness Enumeration

CWE-190

CWE-189

Related Identifiers

BDU:2015-11362

CVE-2015-2519

Affected Products

Windows 10

Windows 7

Windows 8

Windows 8.1

Windows Journal

Windows Rt

Windows Server 2008

Windows Server 2012

Windows Vista

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2015-2519 · Security Note
• https://bdu.fstec.ru/vul/2015-11362 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-098 · Vendor Advisory
• http://securitytracker.com/id/1033484 · Note
• http://technet.microsoft.com/security/bulletin/MS15-098 · Note