PT-2015-4436 · Microsoft · Windows

Published 2015-02-10 · Updated 2019-05-14 · CVE-2015-0061

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue arises from improper initialization of memory for TIFF images, allowing remote attackers to obtain sensitive information from process memory via a crafted image file. This is an information disclosure vulnerability that occurs when Windows fails to properly handle uninitialized memory when parsing certain, specially crafted TIFF image format files. An attacker who successfully exploits this could potentially read data not intended to be disclosed, which could be used to try to further compromise the affected system.

Recommendations For all affected versions, update to a version that properly initializes memory for TIFF images to prevent information disclosure. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-0061

Affected Products

Windows

References · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0061 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-0061 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-016 · Vendor Advisory
• http://securitytracker.com/id/1031725 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100436 · Note
• http://technet.microsoft.com/security/bulletin/ms15-016 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/100435 · Note
• http://securityfocus.com/bid/72456 · Note