Information disclosure in Microsoft Windows and Windows Server - CVE-2015-1676

Vulnerability identifier: #VU5548

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2015-1676

CWE-ID: CWE-401

Exploitation vector: Remote access

Exploit availability: Public exploit is available

The vulnerabiity allows a remote attacker to obtain potentially sensitive information on the target system.

The weakness exists due to private address information leaking during a function call. A remote attacker can bypass the ASLR protection mechanism, gain access to sensitive information and use it to launch further attacks against the affected system.

Successful exploitation of this vulnerability results in information disclosure on the vulnerable system.

Microsoft Windows
Windows Server

Install update from vendor's website.

• Exploit #962 - Microsoft Windows - Privilege Escalation (MS15-051) (March 18, 2020)

• https://technet.microsoft.com/en-us/library/security/ms15-051

• Multiple vulnerabilities in Microsoft Windows
• Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege