CVE-2015-2428 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Windows Server 2008

CWE-264CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer7 documents4 sources
Severity
2.1LOWNVD
NVD1.9
EPSS
1.1%
top 22.16%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
6
Adobe Acrobat DCAdobe Acrobat Reader DCAdobe Acrobat+3 more
Timeline
PublishedAug 15
Latest updateMay 14

Description

Object Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly constrain impersonation levels during interaction with object symbolic links that originated in a sandboxed process, which allows local users to gain privileges via a crafted application, aka "Windows Object Manager Elevation of Privilege Vulnerability."

CVSS vector

AV:L/AC:L/C:N/I:P/A:NExploitability: 3.9 | Impact: 2.9

Affected Packages5 packages

▶NVDadobe/acrobat_dc15.006.30060 — 15.006.30094+1
▶NVDadobe/acrobat_reader_dc15.006.30060 — 15.006.30094+1
▶NVDadobe/acrobat10.0 — 10.1.15+1
▶NVDadobe/acrobat_reader10.0 — 10.1.15+1

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-x487-p4jj-jg25: Object Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8↗2022-05-14
▶
GHSA
GHSA-5p5f-7qvc-xw5j: Adobe Reader and Acrobat 10↗2022-05-13
▶
Project0
Windows 10^H^H Symbolic Link Mitigations - Project Zero↗2015-08-01
▶

🕵️Threat Intelligence

2
Talos
Microsoft Patch Tuesday - August 2015↗2015-08-11
▶
Talos
Microsoft Patch Tuesday - August 2015↗2015-08-11
▶