PT-2016-2893 · Microsoft · Windows+2

Published 2016-06-14 · Updated 2023-02-23 · CVE-2016-3201

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows versions 8.1, 10 Gold, and 10 1511 Microsoft Edge Microsoft Windows Server versions 2012 Gold and 2012 R2

Description A issue allows remote attackers to obtain sensitive information from process memory via a crafted PDF document. Information disclosure occurs when a user opens a specially crafted .pdf file, potentially allowing an attacker to read information in the context of the current user.

Recommendations For Microsoft Windows versions 8.1, 10 Gold, and 10 1511, update to a version that includes the fix for this issue. For Microsoft Edge, update to a version that includes the fix for this issue. For Microsoft Windows Server versions 2012 Gold and 2012 R2, update to a version that includes the fix for this issue. As a temporary workaround, consider avoiding the use of Microsoft Edge to open PDF documents from untrusted sources until a patch is available. Restrict access to PDF files from untrusted sources to minimize the risk of exploitation.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-02324

CVE-2016-3201

Affected Products

Edge

Windows

Windows Server

References · 11

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-080 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3201 · Security Note
• https://bdu.fstec.ru/vul/2016-02324 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3201 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3201 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-068 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2016-3201 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS16-068 · Note
• http://technet.microsoft.com/security/bulletin/MS16-080 · Note
• http://technet.microsoft.com/library/security/ms16-068 · Note
• http://securitytracker.com/id/1036099 · Note