PT-2015-2956 · Microsoft · Windows

Published 2015-12-08 · Updated 2019-05-16 · CVE-2015-6126

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to a race condition in the Pragmatic General Multicast (PGM) protocol implementation. It allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application. The vulnerability exists due to insufficient checking of the resource state when it can be shared.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Race Condition

Weakness Enumeration

CWE-416

CWE-362

Related Identifiers

BDU:2016-00053

CVE-2015-6126

Affected Products

Windows

References · 5

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-133 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-6126 · Security Note
• https://bdu.fstec.ru/vul/2016-00053 · Security Note
• http://securitytracker.com/id/1034339 · Note
• http://technet.microsoft.com/security/bulletin/MS15-133 · Note