Veille CVE
CVE-2019-1458
7.8 Élevée Exploitée activement Utilisée par des rançongicielsCatalogue CISA KEV — Microsoft Win32k Privilege Escalation Vulnerability
Ajoutée le 10/01/2022 · Échéance de correction (agences US) : 10/07/2022
Action requise : Apply updates per vendor instructions.
Description
An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 3.1 | 7.8 Élevée | nvd@nist.gov (NVD) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | 7.8 Élevée | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 2.0 | 7.2 Élevée | nvd@nist.gov (NVD) | AV:L/AC:L/Au:N/C:C/I:C/A:C |
Références
- http://packetstormsecurity.com/files/156651/Microsoft-Windows-WizardOpium-Local-Privilege-Escalation.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/159569/Microsoft-Windows-Uninitialized-Variable-Local-Privilege-Escalation.html ExploitThird Party AdvisoryVDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458 PatchVendor Advisory
- http://packetstormsecurity.com/files/156651/Microsoft-Windows-WizardOpium-Local-Privilege-Escalation.html ExploitThird Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/159569/Microsoft-Windows-Uninitialized-Variable-Local-Privilege-Escalation.html ExploitThird Party AdvisoryVDB Entry
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1458 PatchVendor Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-1458 US Government Resource