PT-2016-1053 · Microsoft · Windows

Published 2016-01-12 · Updated 2019-05-15 · CVE-2016-0008

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions prior to the fixed version

Description The issue is related to the graphics device interface in Microsoft Windows, which lacks protection for certain data. This allows a remote attacker to bypass the Address Space Layout Randomization (ASLR) protection mechanism. The vulnerability exists in the way the Windows graphics device interface handles objects in memory, enabling an attacker to retrieve information that could lead to an ASLR bypass.

Recommendations For Microsoft Windows versions prior to the fixed version, update to the latest version to resolve the issue. As a temporary workaround, consider restricting access to the graphics device interface to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-00120

CVE-2016-0008

Affected Products

Windows

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2016-0008 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-005 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0008 · Security Note
• https://bdu.fstec.ru/vul/2016-00120 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0008 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS16-005 · Note
• http://technet.microsoft.com/security/bulletin/ms16-005 · Note
• https://verisign.com/en_US/security-services/security-intelligence/vulnerability-reports/articles/index.xhtml?id=1216 · Note
• http://securitytracker.com/id/1034654 · Note