ID CVE-2016-0041
Summary Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability." <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
    cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
CVSS
Base: 7.2 (as of 12-10-2018 - 22:10)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
COMPLETE COMPLETE COMPLETE
cvss-vector via4 AV:L/AC:L/Au:N/C:C/I:C/A:C
msbulletin via4
  • bulletin_id MS16-014
    bulletin_url
    date 2016-02-09T00:00:00
    impact Remote Code Execution
    knowledgebase_id 3134228
    knowledgebase_url
    severity Important
    title Security Update for Microsoft Windows to Address Remote Code Execution
  • bulletin_id MS16-009
    bulletin_url
    date 2016-02-09T00:00:00
    impact Remote Code Execution
    knowledgebase_id 3134220
    knowledgebase_url
    severity Critical
    title Cumulative Security Update for Internet Explorer
refmap via4
fulldisc 20160210 NPS Datastore server DLL side loading vulnerability
misc https://www.securify.nl/advisory/SFY20150905/nps_datastore_server_dll_side_loading_vulnerability.html
sectrack
  • 1034971
  • 1034985
Last major update 12-10-2018 - 22:10
Published 10-02-2016 - 11:59
Last modified 12-10-2018 - 22:10
Back to Top