PT-2015-4450 · Microsoft · Windows Rt+7

Published 2015-03-10 · Updated 2019-05-14 · CVE-2015-0076

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Vista SP2 Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8 Microsoft Windows 8.1 Microsoft Windows Server 2012 Gold and R2 Microsoft Windows RT Gold and 8.1

Description The issue arises from the improper initialization of memory for rendering JXR images, allowing remote attackers to obtain sensitive information from process memory via a crafted web site. An information disclosure vulnerability exists when Windows fails to properly handle uninitialized memory when parsing certain, specially crafted JPEG XR (.JXR) image format files. This could allow an attacker to read data that was not intended to be disclosed, potentially obtaining information that could be used to further compromise the affected system.

Recommendations For Microsoft Windows Vista SP2, update to a newer version that properly initializes memory for JXR image rendering. For Microsoft Windows Server 2008 SP2 and R2 SP1, update to a newer version that properly handles uninitialized memory when parsing JPEG XR image files. For Microsoft Windows 7 SP1, update to a newer version that fixes the information disclosure vulnerability. For Microsoft Windows 8, update to a newer version that properly handles JXR image rendering. For Microsoft Windows 8.1, update to a newer version that fixes the issue with uninitialized memory. For Microsoft Windows Server 2012 Gold and R2, update to a newer version that properly handles JPEG XR image files. For Microsoft Windows RT Gold and 8.1, update to a newer version that fixes the information disclosure vulnerability.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-0076

Affected Products

Windows

Windows 7

Windows 8

Windows 8.1

Windows Rt

Windows Server 2008

Windows Server 2012

Windows Vista

References · 6

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0076 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-029 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-0076 · Security Note
• http://securityfocus.com/bid/72918 · Note
• http://technet.microsoft.com/security/bulletin/ms15-029 · Note
• http://securitytracker.com/id/1031894 · Note