CVE-2014-4060

EPSS 16.01%
Published 12.08.2014 21:55:07
Last modified 12.04.2025 10:46:40
Source secure@microsoft.com
Teams watchlist Login
Open Login

Use-after-free vulnerability in MCPlayer.dll in Microsoft Windows Media Center TV Pack for Windows Vista, Windows 7 SP1, and Windows Media Center for Windows 8 and 8.1 allows remote attackers to execute arbitrary code via a crafted Office document that triggers deletion of a CSyncBasePlayer object, aka "CSyncBasePlayer Use After Free Vulnerability."

Affected products Warnungen 0 Metrics 2 CWE 1 References 6

Data is provided by the National Vulnerability Database (NVD)

Microsoft ≫ Windows Media Center Version-

Microsoft ≫ Windows 8 Version- SwEditionprofessional
Microsoft ≫ Windows 8.1 Version- SwEditionprofessional

Microsoft ≫ Windows Media Center Tv Pack Version-

   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionenterprise
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionenterprise_kn
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionenterprise_n
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionhome_premium
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionhome_premium_kn
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionhome_premium_n
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionprofessional
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionprofessional_kn
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionprofessional_n
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionultimate
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionultimate_kn
   Microsoft ≫ Windows 7 Version- Updatesp1 SwEditionultimate_n
   Microsoft ≫ Windows Vista

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	16.01%	0.942

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	6.8	8.6	6.4	AV:N/AC:M/Au:N/C:P/I:P/A:P

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://secunia.com/advisories/60671

Third Party Advisory

http://www.securityfocus.com/bid/69093

Third Party Advisory

VDB Entry

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-043

Patch

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2014-4060

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2014-4060

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2014-4060

EUVD