CVE-2011-1265
The Bluetooth Stack 2.1 in Microsoft Windows Vista SP1 and SP2 and Windows 7 Gold and SP1 does not prevent access to objects in memory that (1) were not properly initialized or (2) have been deleted, which allows remote attackers to execute arbitrary…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (5.95%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
The Bluetooth Stack 2.1 in Microsoft Windows Vista SP1 and SP2 and Windows 7 Gold and SP1 does not prevent access to objects in memory that (1) were not properly initialized or (2) have been deleted, which allows remote attackers to execute arbitrary code via crafted Bluetooth packets, aka "Bluetooth Stack Vulnerability."
- CVSS 3.1
- 8.8 HIGHCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 5.95% probability · 93th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-94
- Affected
- bluetooth/bluetooth stack · microsoft/windows 7 · microsoft/windows vista
- Source
- secure@microsoft.com
References
- http://www.us-cert.gov/cas/techalerts/TA11-193A.htmlThird Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-053Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12094Tool Signature
- http://www.us-cert.gov/cas/techalerts/TA11-193A.htmlThird Party Advisory, US Government Resource
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-053Patch, Vendor Advisory
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12094Tool Signature
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.