SB2016110903 - Remote code execution in Microsoft Windows

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2016110903

SB2016110903 - Remote code execution in Microsoft Windows

Published: November 9, 2016

Security Bulletin ID SB2016110903
CSH Severity
High
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Remote code execution (CVE-ID: CVE-2016-7212)

CWE-ID: CWE-20 - Improper input validation

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber


A remote attacker can execute arbitrary code on the target system.

The vulnerability exists due to unknown error when handling images. A remote attacker can create a specially crafted image and execute arbitrary code on the target system with privileges of the current user, when malicious images is viewed.

Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.


Remediation

Install update from vendor's website.

References