Login Request a demo
Unscored severity · published May 13, 2015
CVE-2015-1674
The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate an unspecified address, which allows local…
–
CVSS
3.3%
EPSS
No
On KEV
Description
The kernel in Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly validate an unspecified address, which allows local users to bypass the KASLR protection mechanism, and consequently discover the cng.sys base address, via a crafted application, aka "Windows Kernel Security Feature Bypass Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)3.3% · higher than 89% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
W8
Windows 8 · Microsoft
All versions, or not specified · source: NVD
W8
Windows 8.1 · Microsoft
All versions, or not specified · source: NVD
WR
Windows RT · Microsoft
All versions, or not specified · source: NVD
WR
Windows RT 8.1 · Microsoft
All versions, or not specified · source: NVD
WS
Windows Server 2012 · Microsoft
r2 · source: NVD
Affected product
W8
Windows 8
Microsoft
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-1674
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-1674
Third Party Advisory
http://www.securityfocus.com/bid/74488
Third Party Advisory
http://www.securitytracker.com/id/1032292
Patch
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-052
Exploit
https://www.exploit-db.com/exploits/37052/
More from Windows 8
9.8
CVE-2015-1635
Microsoft HTTP.sys Remote Code Execution Vulnerability
8.8
CVE-2015-2426
Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability
8.8
CVE-2015-2360
Microsoft Win32k Privilege Escalation Vulnerability
8.8
CVE-2014-6324
Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability
8.8
CVE-2014-6332
Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability