CVE-2016-0175 — Sensitive Information Exposure in Microsoft Windows 10

CWE-200 — Sensitive Information Exposure12 documents7 sources
Severity
3.3LOWNVD
EPSS
0.7%
top 26.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
14
Microsoft Windows 10Microsoft Windows Server 2008Microsoft Windows Server 2012+11 more
Timeline
PublishedMay 11
Latest updateMay 14

Description

The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allow local users to obtain sensitive information about kernel-object addresses, and consequently bypass the KASLR protection mechanism, via a crafted application, aka "Win32k Information Disclosure Vulnerability."

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages13 packages

🔴Vulnerability Details

1
GHSA
GHSA-fx53-9f22-cghg: The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8↗2022-05-14
▶

📋Vendor Advisories

1
Microsoft
Win32k Information Disclosure Vulnerability↗2016-05-10
▶

🕵️Threat Intelligence

7
Talos
Vulnerability Spotlight: Kaspersky Unhandled Windows Messages Denial of Service Vulnerability↗2016-09-06
▶
Talos
Vulnerability Spotlight: Kaspersky Unhandled Windows Messages Denial of Service Vulnerability↗2016-09-06
▶
Talos
Vulnerability Spotlight: Kaspersky Unhandled Windows Messages Denial of Service Vulnerability↗2016-08-26
▶
Talos
Vulnerability Spotlight: Kaspersky Unhandled Windows Messages Denial of Service Vulnerability↗2016-08-26
▶
Talos
Microsoft Patch Tuesday - May 2016↗2016-05-10
▶

📄Research Papers

1
arXiv
Rethinking Misalignment to Raise the Bar for Heap Pointer Corruption↗2018-08-08
▶

💬Community

1
Bugzilla
CVE-2016-8328 Oracle JDK: unspecified vulnerability fixed in 8u121 (Java Mission Control)↗2017-01-17
▶