CVE-2008-4268
The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation for a Windows Search file, which allows remote attackers to execute arbitrary code via a crafted saved-search…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 20.7%, higher than 97% of all known CVEs. Patch or mitigate before the next change window.
Description
The Windows Search component in Microsoft Windows Vista Gold and SP1 and Server 2008 does not properly free memory during a save operation for a Windows Search file, which allows remote attackers to execute arbitrary code via a crafted saved-search file, aka "Windows Saved Search Vulnerability."
- CVSS 2.0
- 8.5 HIGHAV:N/AC:M/Au:S/C:C/I:C/A:C
- EPSS
- 20.68% probability · 97th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-399
- Affected
- microsoft/windows server 2008 · microsoft/windows vista
- Source
- secure@microsoft.com
References
- http://secunia.com/advisories/33053
- http://www.securitytracker.com/id?1021366
- http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3387
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-075
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5853
- http://secunia.com/advisories/33053
- http://www.securitytracker.com/id?1021366
- http://www.us-cert.gov/cas/techalerts/TA08-344A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2008/3387
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-075
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5853
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.