CVE-2015-0096
HighSummary
A vulnerability in Microsoft Windows systems allows local users to gain privileges via a malicious DLL in the current working directory. The issue occurs when accessing the icon of crafted shortcuts in Windows Explorer.
Risk Assessment
Exploitation of this vulnerability could lead to remote code execution, posing a serious threat to the security of systems and organizational data.
Recommendation
It is recommended to update systems to the latest versions and restrict local users' ability to modify files in current working directories.
Other vulnerabilities in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1
See all- CVE-2015-1645High
The vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to execute arbitrary code via a crafted Enhanced Metafile (EMF) image.
- CVE-2015-0008High
The UNC implementation in Microsoft Windows lacks server-to-client authentication, allowing remote attackers to execute arbitrary code by making crafted data available on a UNC share.
Original NVD description (English source)
Untrusted search path vulnerability in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, leading to DLL loading during Windows Explorer access to the icon of a crafted shortcut, aka "DLL Planting Remote Code Execution Vulnerability."