Information disclosure in Microsoft products - CVE-2016-3209
Published: October 11, 2016 / Updated: September 14, 2018
Vulnerability identifier: #VU959
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-3209
CWE-ID: CWE-401
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local attacker to obtain potentially sensitive information on the target system.
The weakness exists due to boundary error in the Graphics Device Interface (GDI) component. A local attacker can execute a specially crafted program on the affected system, get information about system memory state, bypass Address Space Layout Randomization (ASLR) and conduct further attacks.
Successful exploitation of the vulnerability will result in information disclosure on the vulnerable system.
The weakness exists due to boundary error in the Graphics Device Interface (GDI) component. A local attacker can execute a specially crafted program on the affected system, get information about system memory state, bypass Address Space Layout Randomization (ASLR) and conduct further attacks.
Successful exploitation of the vulnerability will result in information disclosure on the vulnerable system.
Affected software
Microsoft Windows
Windows Server
Microsoft .NET Framework
Microsoft Silverlight
Microsoft Office
Microsoft Live Meeting
Microsoft Lync
Lync Attendee
Windows Server
Microsoft .NET Framework
Microsoft Silverlight
Microsoft Office
Microsoft Live Meeting
Microsoft Lync
Lync Attendee
How to mitigate CVE-2016-3209
Install update fron vendor's website.