deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2015-0008
Published: 2015-02-11
Description: The UNC implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not include authentication from the server to the client, which allows remote attackers to execute arbitrary code by making crafted data available on a UNC share, as demonstrated by Group Policy data from a spoofed domain controller, aka "Group Policy Remote Code Execution Vulnerability."
CVSS Score: 8.3 (HIGH)
CWE: CWE-284
References: http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx; http://packetstormsecurity.com/files/155002/Microsoft-Windows-Server-2012-Group-Policy-Remote-Code-Execution.html; http://www.kb.cert.org/vuls/id/787252
CVE: CVE-2015-0009
Published: 2015-02-11
Description: The Group Policy Security Configuration policy implementation in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows man-in-the-middle attackers to disable a signing requirement and trigger a revert-to-default action by spoofing domain-controller responses, aka "Group Policy Security Feature Bypass Vulnerability."
CVSS Score: 3.3 (LOW)
CWE: CWE-254
References: http://blogs.technet.com/b/srd/archive/2015/02/10/ms15-011-amp-ms15-014-hardening-group-policy.aspx; http://packetstormsecurity.com/files/155007/Microsoft-Windows-Server-2012-Group-Policy-Security-Feature-Bypass.html; http://www.securityfocus.com/bid/72476
CVE: CVE-2015-0010
Published: 2015-02-11
Description: The CryptProtectMemory function in cng.sys (aka the Cryptography Next Generation driver) in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1, when the CRYPTPROTECTMEMORY_SAME_LOGON option is used, does not check an impersonation token's level, which allows local users to bypass intended decryption restrictions by leveraging a service that (1) has a named-pipe planting vulnerability or (2) uses world-readable shared memory for encrypted data, aka "CNG Security Feature Bypass Vulnerability" or MSRC ID 20707.
CVSS Score: 1.9 (LOW)
CWE: CWE-310
References: http://code.google.com/p/google-security-research/issues/detail?id=128; http://www.securityfocus.com/bid/72461; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010
CVE: CVE-2015-0012
Published: 2015-02-11
Description: Microsoft System Center Virtual Machine Manager (VMM) 2012 R2 Update Rollup 4 does not properly validate the roles of users, which allows local users to obtain server and virtual-machine administrative privileges by establishing a server session with Active Directory credentials, aka "Virtual Machine Manager Elevation of Privilege Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72473; http://www.securitytracker.com/id/1031726; http://www.securitytracker.com/id/1034652
CVE: CVE-2015-0017
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72402; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0018
Published: 2015-02-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0037, CVE-2015-0040, and CVE-2015-0066.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72403; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0019
Published: 2015-02-11
Description: Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72425; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0020
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72426; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0021
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72436; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0022
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72437; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0023
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0025.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72438; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0025
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0023.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72439; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0026
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0030, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72440; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0027
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0035, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72441; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0028
Published: 2015-02-11
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0048.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72442; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0029
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 and 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72443; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0030
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0031, CVE-2015-0036, and CVE-2015-0041.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72444; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0031
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0036, and CVE-2015-0041.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72445; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0035
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0039, CVE-2015-0052, and CVE-2015-0068.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72447; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0036
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0041.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72446; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0037
Published: 2015-02-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0040, and CVE-2015-0066.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72448; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0038
Published: 2015-02-11
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0042 and CVE-2015-0046.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72404; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0039
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0052, and CVE-2015-0068.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72409; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0040
Published: 2015-02-11
Description: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0018, CVE-2015-0037, and CVE-2015-0066.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://www.securityfocus.com/archive/1/539752/100/0/threaded; http://www.securityfocus.com/bid/72410
CVE: CVE-2015-0041
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0017, CVE-2015-0020, CVE-2015-0022, CVE-2015-0026, CVE-2015-0030, CVE-2015-0031, and CVE-2015-0036.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72411; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0042
Published: 2015-02-11
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0046.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72412; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0043
Published: 2015-02-11
Description: Microsoft Internet Explorer 8 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72413; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0044
Published: 2015-02-11
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0050.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72414; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0045
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0053.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72415; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0046
Published: 2015-02-11
Description: Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0038 and CVE-2015-0042.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72416; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0048
Published: 2015-02-11
Description: Microsoft Internet Explorer 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0028.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72417; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0049
Published: 2015-02-11
Description: Microsoft Internet Explorer 8 and 10 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability."
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72418; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0050
Published: 2015-02-11
Description: Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0044.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://blog.skylined.nl/[PII_REDACTED]1.html; http://seclists.org/fulldisclosure/2016/Nov/135; http://www.securityfocus.com/archive/1/539808/100/0/threaded
CVE: CVE-2015-0051
Published: 2015-02-11
Description: Microsoft Internet Explorer 8 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explorer ASLR Bypass Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72453; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0052
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0027, CVE-2015-0035, CVE-2015-0039, and CVE-2015-0068.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72420; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0053
Published: 2015-02-11
Description: Microsoft Internet Explorer 6 through 8 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-0045.
CVSS Score: 9.3 (HIGH)
CWE: CWE-399
References: http://www.securityfocus.com/bid/72421; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0054
Published: 2015-02-11
Description: Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72478; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0055
Published: 2015-02-11
Description: Microsoft Internet Explorer 10 and 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of Privilege Vulnerability."
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72479; http://www.securitytracker.com/id/1031723; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-009
CVE: CVE-2015-0057
Published: 2015-02-11
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted application, aka "Win32k Elevation of Privilege Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72466; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010; https://exchange.xforce.ibmcloud.com/vulnerabilities/100431
CVE: CVE-2015-0058
Published: 2015-02-11
Description: Double free vulnerability in win32k.sys in the kernel-mode drivers in Microsoft Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a crafted application, aka "Windows Cursor Object Double Free Vulnerability."
CVSS Score: 7.2 (HIGH)
CWE: CWE-415
References: http://www.securityfocus.com/bid/72468; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010; https://exchange.xforce.ibmcloud.com/vulnerabilities/100432
CVE: CVE-2015-0059
Published: 2015-02-11
Description: win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a crafted TrueType font, aka "TrueType Font Parsing Remote Code Execution Vulnerability."
CVSS Score: 6.9 (MEDIUM)
CWE: CWE-264
References: http://www.securityfocus.com/bid/72470; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010; https://exchange.xforce.ibmcloud.com/vulnerabilities/100433
CVE: CVE-2015-0060
Published: 2015-02-11
Description: The font mapper in win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly scale fonts, which allows local users to cause a denial of service (system hang) via a crafted application, aka "Windows Font Driver Denial of Service Vulnerability."
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-19
References: http://www.securityfocus.com/bid/72472; https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-010; https://exchange.xforce.ibmcloud.com/vulnerabilities/100434