CVE-2016-3372
The kernel API in Microsoft Windows Vista SP2 and Windows Server 2008 SP2 does not properly enforce permissions, which allows local users to spoof processes, spoof inter-process communication, or cause a denial of service via a crafted application, aka…
Does this matter?
Lower severity and a low EPSS score (2.23%). Track it; it rarely justifies an emergency change on its own.
Description
The kernel API in Microsoft Windows Vista SP2 and Windows Server 2008 SP2 does not properly enforce permissions, which allows local users to spoof processes, spoof inter-process communication, or cause a denial of service via a crafted application, aka "Windows Kernel Elevation of Privilege Vulnerability."
- CVSS 3.0
- 6.6 MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:H/A:H
- EPSS
- 2.23% probability · 82th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- microsoft/windows server 2008 · microsoft/windows vista
- Source
- secure@microsoft.com
References
- http://www.securityfocus.com/bid/92815
- http://www.securitytracker.com/id/1036802
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-111
- http://www.securityfocus.com/bid/92815
- http://www.securitytracker.com/id/1036802
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-111
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.