PT-2016-2185 · Microsoft · Windows+2

Kdot · Published 2016-06-14 · Updated 2019-05-15 · CVE-2016-3215

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10 1511 Microsoft Edge Microsoft Windows Server versions 2012 Gold and R2

Description The issue is related to a lack of protection for service data in Microsoft Windows and the Microsoft Edge browser. Exploitation of this issue may allow a remote attacker to obtain confidential information using a specially crafted PDF document. This can occur when a user opens a specially crafted .pdf file, potentially allowing an attacker to read information in the context of the current user.

Recommendations For Microsoft Windows versions 8.1, 10 1511, and Microsoft Windows Server versions 2012 Gold and R2, update to a version that includes the fix for this issue. For Microsoft Edge, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of specially crafted PDF documents until a patch is available. Restrict access to sensitive information to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-01538

CVE-2016-3215

ZDI-16-370

Affected Products

Edge

Windows

Windows Server

References · 13

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-080 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3215 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3215 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3215 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01538 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-068 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3215 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-16-370 · Security Note
• http://zerodayinitiative.com/advisories/ZDI-16-370 · Note
• http://technet.microsoft.com/security/bulletin/MS16-068 · Note
• http://securitytracker.com/id/1036099 · Note
• http://technet.microsoft.com/security/bulletin/MS16-080 · Note
• http://technet.microsoft.com/library/security/ms16-068 · Note