Null pointer dereference in Windows and Windows Server - CVE-2015-1721

Vulnerability identifier: #VU5382

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber

CVE-ID: CVE-2015-1721

CWE-ID: CWE-476

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vendor: Microsoft

Affected software:
Windows
Windows Server

The vulnerability allows a local attacker to obtain elevated privileges on the target system.

The weakness exists due to null pointer dereference. A local attacker can run a specially crafted program to gain administrative privileges and execute arbitrary code in kernel mode.

Successful exploitation of the vulnerability may result in arbitrary code execution on the vulnerable system.

Install update from vendor's website.

• https://technet.microsoft.com/en-us/library/security/ms15-061