PT-2016-1396 · Microsoft · Windows Server 2008 R2 Sp1+5

Published 2016-03-09 · Updated 2018-10-12 · CVE-2016-0098

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows Server 2008 R2 SP1 Windows 7 SP1 Windows 8.1 Windows Server 2012 Gold and R2 Windows RT 8.1 Windows 10

Description The issue exists due to insufficient input validation in the Windows operating system, allowing remote attackers to execute arbitrary code via crafted media content.

Recommendations For Windows Server 2008 R2 SP1, update to a newer version that contains a fix for this issue. For Windows 7 SP1, update to a newer version that contains a fix for this issue. For Windows 8.1, update to a newer version that contains a fix for this issue. For Windows Server 2012 Gold and R2, update to a newer version that contains a fix for this issue. For Windows RT 8.1, update to a newer version that contains a fix for this issue. For Windows 10, update to a newer version that contains a fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2016-00695

CVE-2016-0098

Affected Products

Windows 10

Windows 7 Sp1

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2 Sp1

Windows Server 2012

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2016-0098 · Security Note
• https://bdu.fstec.ru/vul/2016-00695 · Security Note
• https://osv.dev/vulnerability/CVE-2016-0098 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-027 · Vendor Advisory
• http://securityfocus.com/bid/84089 · Note
• http://technet.microsoft.com/security/bulletin/MS16-027 · Note
• http://securitytracker.com/id/1035200 · Note