CVE Vulnerabilities

CVE-2019-0853

Access of Uninitialized Pointer

Published: Apr 09, 2019 | Modified: Mar 20, 2023
CVSS 3.x
8.8
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.x
9.3 HIGH
AV:N/AC:M/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka GDI+ Remote Code Execution Vulnerability.

Weakness

The product accesses or uses a pointer that has not been initialized.

Affected Software

Name Vendor Start Version End Version
Windows_server_2008 Microsoft r2 r2
Windows_server_2012 Microsoft r2 r2
Windows_server_2008 Microsoft r2 r2
Windows_10 Microsoft 1607 1607
Windows_8.1 Microsoft - -
Windows_server_2016 Microsoft - -
Windows_server_2008 Microsoft - -
Windows_7 Microsoft - -
Windows_rt_8.1 Microsoft - -
Windows_10 Microsoft 1703 1703
Windows_server_2012 Microsoft - -
Windows_10 Microsoft - -
Windows_10 Microsoft 1709 1709
Windows_server_2016 Microsoft 1709 1709
Windows_10 Microsoft 1803 1803
Windows_server_2016 Microsoft 1803 1803
Windows_server_2019 Microsoft - -
Windows_10 Microsoft 1809 1809

Extended Description

If the pointer contains an uninitialized value, then the value might not point to a valid memory location. This could cause the product to read from or write to unexpected memory locations, leading to a denial of service. If the uninitialized pointer is used as a function call, then arbitrary functions could be invoked. If an attacker can influence the portion of uninitialized memory that is contained in the pointer, this weakness could be leveraged to execute code or perform other attacks. Depending on memory layout, associated memory management behaviors, and product operation, the attacker might be able to influence the contents of the uninitialized pointer, thus gaining more fine-grained control of the memory location to be accessed.

References