CVE-2018-0901

Exploit

EPSS 2.41%
Veröffentlicht 14.03.2018 17:29:02
Zuletzt bearbeitet 21.11.2024 03:39:11
Erkennungen
Login

The Windows kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to the way memory addresses are handled, aka "Windows Kernel Information Disclosure Vulnerability". This CVE is unique from CVE-2018-0811, CVE-2018-0813, CVE-2018-0814, CVE-2018-0894, CVE-2018-0895, CVE-2018-0896, CVE-2018-0897, CVE-2018-0898, CVE-2018-0899, CVE-2018-0900, and CVE-2018-0926.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 2 Referenzen 7

NVD 14 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ Windows 10 Version -

Microsoft ≫ Windows 10 Version 1511

Microsoft ≫ Windows 10 Version 1607

Microsoft ≫ Windows 10 Version 1703

Microsoft ≫ Windows 10 Version 1709

Microsoft ≫ Windows 7 Version - Update sp1

Microsoft ≫ Windows 8.1 Version -

Microsoft ≫ Windows Rt 8.1 Version -

Microsoft ≫ Windows Server Version 1709

Microsoft ≫ Windows Server 2008 Version - Update sp2

Microsoft ≫ Windows Server 2008 Version r2 Update sp1

Microsoft ≫ Windows Server 2012

Microsoft ≫ Windows Server 2012 Version r2

Microsoft ≫ Windows Server 2016 Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	2.41%	0.823

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	4.7	1	3.6	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NIST	1.9	3.4	2.9	AV:L/AC:M/Au:N/C:P/I:N/A:N

CWE-401 Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

CWE-665 Improper Initialization

The product does not initialize or incorrectly initializes a resource, which might leave the resource in an unexpected state when it is accessed or used.

http://www.securitytracker.com/id/1040517

Third Party Advisory

VDB Entry

http://www.securityfocus.com/bid/103245

Third Party Advisory

VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0901

Patch

Vendor Advisory

https://www.exploit-db.com/exploits/44311/

Third Party Advisory

Exploit

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2018-0901

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-0901

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-0901

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2018-0901