PT-2016-2172 · Microsoft · Office+2

Published 2016-06-14 · Updated 2019-05-08 · CVE-2016-3232

Positive Technologies (AI Summary)

CVSS v3.1

5.0

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows Server versions 2012 Gold and R2

Description The issue allows local users to obtain sensitive information from uninitialized memory locations via a crafted application. It is also described as allowing attackers to obtain sensitive information and affect the system. Additionally, there's a mention of a buffer overflow vulnerability in a virtual service provider, potentially allowing remote attackers to execute arbitrary code with a specially crafted Office document.

Recommendations For Microsoft Windows Server 2012 Gold and R2, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-01525

CVE-2016-3232

Affected Products

Office

Windows Server

Windows

References · 8

• https://osv.dev/vulnerability/CVE-2016-3232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3232 · Security Note
• https://bdu.fstec.ru/vul/2016-01525 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3232 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3232 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-073 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS16-073 · Note
• http://securitytracker.com/id/1036109 · Note