The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

Computer vulnerabilities of Windows 2008 R0

cybersecurity weakness CVE-2016-3216 CVE-2016-3219 CVE-2016-3220

Microsoft Windows: three vulnerabilities via Graphics Component

Synthesis of the vulnerability

An attacker can use several vulnerabilities via Graphics Component of Microsoft Windows.
Severity: 3/4.
Number of vulnerabilities in this bulletin: 3.
Creation date: 15/06/2016.
Revisions dates: 21/06/2016, 15/02/2017.
Identifiers: 3164036, 779, 785, 992, CERTFR-2016-AVI-206, CVE-2016-3216, CVE-2016-3219, CVE-2016-3220, MS16-074, VIGILANCE-VUL-19887.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Microsoft Windows.

An attacker can get nformation useful to bypass ASLR. [severity:3/4; CVE-2016-3216]

An attacker can corrupt an object in memory, in order to get kernel privileges. [severity:3/4; 779, CVE-2016-3219]

An attacker can bypass security features via ATMFD.dll, in order to escalate his privileges. [severity:3/4; 785, CVE-2016-3220]
Full Vigil@nce bulletin... (Free trial)

threat announce CVE-2017-0038

Microsoft Windows: information disclosure via gdi32.dll

Synthesis of the vulnerability

A local attacker can trigger a read only buffer overflow via gdi32.dll of Microsoft Windows via a data structure of type EMR_SETDIBITSTODEVICE, in order to get sensitive information.
Severity: 1/4.
Creation date: 15/02/2017.
Identifiers: 3208223, 4010318, 4010319, 4010320, 4010321, 4013074, 4013075, 4013076, 4013078, 4013081, 4013082, 4013083, 4013389, 992, CERTFR-2017-ALE-002, CVE-2017-0038, MS17-008, MS17-009, MS17-010, MS17-011, MS17-012, MS17-013, MS17-016, MS17-017, MS17-018, MS17-019, MS17-020, MS17-021, MS17-022, VIGILANCE-VUL-21837.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

A local attacker can trigger a read only buffer overflow via gdi32.dll of Microsoft Windows via a data structure of type EMR_SETDIBITSTODEVICE, in order to get sensitive information.

The bulletin VIGILANCE-VUL-19887 indicates a similar vulnerability (CVE-2016-3216), which has been fixed as annouced in MS16-074.
Full Vigil@nce bulletin... (Free trial)

security weakness 21760

Windows: memory corruption via SMB Tree Connect Response

Synthesis of the vulnerability

An attacker can generate a memory corruption via SMB Tree Connect Response on a Windows client, in order to trigger a denial of service, and possibly to run code.
Severity: 3/4.
Creation date: 03/02/2017.
Identifiers: VIGILANCE-VUL-21760, VU#867968.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The Windows system can connect to a remote share, using the SMB/CIFS protocol.

When a SMB client connects, it sends a SMB2 TREE_CONNECT Request message to the server. It then returns a SMB2 TREE_CONNECT Response message to the client. However, if this message contains too many data, the client memory is corrupted.

An attacker can therefore generate a memory corruption via SMB Tree Connect Response on a Windows client, in order to trigger a denial of service, and possibly to run code.
Full Vigil@nce bulletin... (Free trial)

cybersecurity alert 21708

ASP.NET Core 1.1.0: denial of service via HTTP

Synthesis of the vulnerability

An attacker can send malicious HTTP packets to an application linked to ASP.NET Core 1.1.0, in order to trigger a denial of service.
Severity: 2/4.
Creation date: 30/01/2017.
Identifiers: 4010983, VIGILANCE-VUL-21708.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

The ASP.NET Core 1.1.0 product manages received HTTP queries.

However, when malicious HTTP queries are received, a fatal error occurs.

An attacker can therefore send malicious HTTP packets to an application linked to ASP.NET Core 1.1.0, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

threat bulletin CVE-2017-0004

Windows: denial of service via LSASS

Synthesis of the vulnerability

An attacker can generate a fatal error via LSASS (Local Security Authority Subsystem Service) of Windows, in order to trigger a denial of service.
Severity: 1/4.
Creation date: 11/01/2017.
Identifiers: 3216771, CERTFR-2017-AVI-010, CVE-2017-0004, MS17-004, VIGILANCE-VUL-21543.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can generate a fatal error via LSASS (Local Security Authority Subsystem Service) of Windows, in order to trigger a denial of service.
Full Vigil@nce bulletin... (Free trial)

computer vulnerability bulletin CVE-2014-0282 CVE-2014-1762 CVE-2014-1764

Internet Explorer: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Internet Explorer.
Severity: 4/4.
Number of vulnerabilities in this bulletin: 4.
Creation date: 10/06/2014.
Revision date: 20/12/2016.
Identifiers: 2969262, CERTFR-2014-AVI-266, CVE-2014-0282, CVE-2014-1762, CVE-2014-1764, CVE-2014-1766, CVE-2014-1769, CVE-2014-1771, CVE-2014-1772, CVE-2014-1773, CVE-2014-1774, CVE-2014-1775, CVE-2014-1777, CVE-2014-1778, CVE-2014-1779, CVE-2014-1780, CVE-2014-1781, CVE-2014-1782, CVE-2014-1783, CVE-2014-1784, CVE-2014-1785, CVE-2014-1786, CVE-2014-1788, CVE-2014-1789, CVE-2014-1790, CVE-2014-1791, CVE-2014-1792, CVE-2014-1794, CVE-2014-1795, CVE-2014-1796, CVE-2014-1797, CVE-2014-1799, CVE-2014-1800, CVE-2014-1802, CVE-2014-1803, CVE-2014-1804, CVE-2014-1805, CVE-2014-2753, CVE-2014-2754, CVE-2014-2755, CVE-2014-2756, CVE-2014-2757, CVE-2014-2758, CVE-2014-2759, CVE-2014-2760, CVE-2014-2761, CVE-2014-2763, CVE-2014-2764, CVE-2014-2765, CVE-2014-2766, CVE-2014-2767, CVE-2014-2768, CVE-2014-2769, CVE-2014-2770, CVE-2014-2771, CVE-2014-2772, CVE-2014-2773, CVE-2014-2775, CVE-2014-2776, CVE-2014-2777, CVE-2014-2782, MS14-035, VIGILANCE-VUL-14876, ZDI-14-174, ZDI-14-175, ZDI-14-176, ZDI-14-177, ZDI-14-178, ZDI-14-179, ZDI-14-180, ZDI-14-181, ZDI-14-182, ZDI-14-183, ZDI-14-184, ZDI-14-185, ZDI-14-186, ZDI-14-212, ZDI-14-213, ZDI-14-226, ZDI-14-227, ZDI-14-237, ZDI-14-259, ZDI-14-260, ZDI-14-270, ZDI-14-354, ZDI-14-357, ZDI-14-366, ZDI-14-367.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Internet Explorer.

An attacker can use a TLS Certificate Renegotiation, in order to obtain sensitive information. [severity:2/4; CVE-2014-1771]

An attacker can read local files, in order to obtain sensitive information. [severity:2/4; CVE-2014-1777]

An attacker can use three vulnerabilities, in order to escalate his privileges. [severity:2/4; CVE-2014-1764, CVE-2014-1778, CVE-2014-2777]

An attacker can generate a memory corruption, in order to trigger a denial of service, and possibly to execute code. [severity:4/4; CVE-2014-0282, CVE-2014-1762, CVE-2014-1766, CVE-2014-1769, CVE-2014-1772, CVE-2014-1773, CVE-2014-1774, CVE-2014-1775, CVE-2014-1779, CVE-2014-1780, CVE-2014-1781, CVE-2014-1782, CVE-2014-1783, CVE-2014-1784, CVE-2014-1785, CVE-2014-1786, CVE-2014-1788, CVE-2014-1789, CVE-2014-1790, CVE-2014-1791, CVE-2014-1792, CVE-2014-1794, CVE-2014-1795, CVE-2014-1796, CVE-2014-1797, CVE-2014-1799, CVE-2014-1800, CVE-2014-1802, CVE-2014-1803, CVE-2014-1804, CVE-2014-1805, CVE-2014-2753, CVE-2014-2754, CVE-2014-2755, CVE-2014-2756, CVE-2014-2757, CVE-2014-2758, CVE-2014-2759, CVE-2014-2760, CVE-2014-2761, CVE-2014-2763, CVE-2014-2764, CVE-2014-2765, CVE-2014-2766, CVE-2014-2767, CVE-2014-2768, CVE-2014-2769, CVE-2014-2770, CVE-2014-2771, CVE-2014-2772, CVE-2014-2773, CVE-2014-2775, CVE-2014-2776, CVE-2014-2782, ZDI-14-174, ZDI-14-175, ZDI-14-176, ZDI-14-177, ZDI-14-178, ZDI-14-179, ZDI-14-180, ZDI-14-181, ZDI-14-182, ZDI-14-183, ZDI-14-184, ZDI-14-185, ZDI-14-186, ZDI-14-212, ZDI-14-213, ZDI-14-226, ZDI-14-227, ZDI-14-237, ZDI-14-259, ZDI-14-260, ZDI-14-270, ZDI-14-354, ZDI-14-357, ZDI-14-366, ZDI-14-367]
Full Vigil@nce bulletin... (Free trial)

cybersecurity threat CVE-2016-7202 CVE-2016-7278 CVE-2016-7279

Internet Explorer: multiple vulnerabilities

Synthesis of the vulnerability

An attacker can use several vulnerabilities of Internet Explorer.
Severity: 4/4.
Number of vulnerabilities in this bulletin: 8.
Creation date: 14/12/2016.
Revision date: 16/12/2016.
Identifiers: 3204059, 972, CERTFR-2016-AVI-413, CVE-2016-7202, CVE-2016-7278, CVE-2016-7279, CVE-2016-7281, CVE-2016-7282, CVE-2016-7283, CVE-2016-7284, CVE-2016-7287, MS16-144, VIGILANCE-VUL-21365.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Internet Explorer.

An attacker can bypass security features via Windows Hyperlink Object Library, in order to obtain sensitive information. [severity:2/4; CVE-2016-7278]

An attacker can bypass security features via Microsoft Browser, in order to obtain sensitive information. [severity:2/4; CVE-2016-7282]

An attacker can bypass security features via Internet Explorer, in order to obtain sensitive information. [severity:2/4; CVE-2016-7284]

An attacker can generate a memory corruption via Microsoft Browser, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2016-7279]

An attacker can generate a memory corruption via Internet Explorer, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2016-7283]

An attacker can bypass security features via Microsoft Browser, in order to escalate his privileges. [severity:3/4; CVE-2016-7281]

An attacker can generate a memory corruption via Scripting Engine, in order to trigger a denial of service, and possibly to run code. [severity:4/4; CVE-2016-7202]

An attacker can generate a memory corruption via Scripting Engine, in order to trigger a denial of service, and possibly to run code. [severity:4/4; 972, CVE-2016-7287]
Full Vigil@nce bulletin... (Free trial)

computer vulnerability alert CVE-2016-7270

Microsoft .NET: information disclosure via SQL Server Always Encrypted

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via SQL Server Always Encrypted of Microsoft .NET, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 14/12/2016.
Identifiers: 3205640, CERTFR-2016-AVI-417, CVE-2016-7270, MS16-155, VIGILANCE-VUL-21378.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via SQL Server Always Encrypted of Microsoft .NET, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

computer threat CVE-2016-7295

Windows: information disclosure via CLFS

Synthesis of the vulnerability

An attacker can bypass access restrictions to data via CLFS of Windows, in order to obtain sensitive information.
Severity: 2/4.
Creation date: 14/12/2016.
Identifiers: 3207328, CERTFR-2016-AVI-416, CVE-2016-7295, MS16-153, VIGILANCE-VUL-21375.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

An attacker can bypass access restrictions to data via Common Log File System Driver of Windows, in order to obtain sensitive information.
Full Vigil@nce bulletin... (Free trial)

security threat CVE-2016-7259 CVE-2016-7260

Windows: two vulnerabilities via Win32k

Synthesis of the vulnerability

An attacker can use several vulnerabilities via Win32k of Windows.
Severity: 2/4.
Number of vulnerabilities in this bulletin: 2.
Creation date: 14/12/2016.
Identifiers: 3205651, CERTFR-2016-AVI-416, CVE-2016-7259, CVE-2016-7260, MS16-151, VIGILANCE-VUL-21373.
Full Vigil@nce bulletin... (Free trial)

Description of the vulnerability

Several vulnerabilities were announced in Windows.

An attacker can bypass security features via Graphics Component, in order to escalate his privileges. [severity:2/4; CVE-2016-7259]

An attacker can bypass security features via Win32k, in order to escalate his privileges. [severity:2/4; CVE-2016-7260]
Full Vigil@nce bulletin... (Free trial)
Our database contains other pages. You can request a free trial to read them.

Display information about Windows 2008 R0: