PT-2015-5748 · Microsoft · Xml Core Services+1

Ucha Gobejishvili · Published 2015-08-11 · Updated 2018-10-12 · CVE-2015-2440

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions 3.0 through 6.0

Description An information disclosure issue exists when Microsoft XML Core Services exposes memory addresses not intended for public disclosure. This could allow an attacker to bypass Address Space Layout Randomization (ASLR) and potentially read private data. The issue does not allow an attacker to execute code or elevate user rights directly but could be used to obtain information to further compromise the affected system.

Recommendations For Microsoft XML Core Services versions 3.0 through 6.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2015-2440

ZDI-15-381

Affected Products

Xml Core Services

Office

References · 8

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-084 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2440 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-381 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2440 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-15-381 · Note
• http://securityfocus.com/bid/76232 · Note
• http://technet.microsoft.com/security/bulletin/ms15-084 · Note
• http://securitytracker.com/id/1033241 · Note