CVE-2015-1763

High

Published: 14/07/2015(UTC)Translated: 16/06/2026(UTC)NVD NIST

Summary

Microsoft SQL Server versions 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 do not prevent the use of uninitialized memory during attempts to execute virtual functions, allowing remote authenticated users to execute arbitrary code via a crafted query.

Risk Assessment

This vulnerability could lead to remote code execution, posing a serious threat to the security of the organization's data and systems.

Recommendation

It is recommended to update Microsoft SQL Server to the latest version to mitigate the risks associated with this vulnerability.

Other vulnerabilities in Microsoft SQL Server 2008 SP3, SP4; 2008 R2 SP2, SP3; 2012 SP1, SP2; 2014

CVE-2015-1762High
A vulnerability in Microsoft SQL Server allows remote authenticated users to execute arbitrary code by leveraging uninitialized memory in function calls related to transactional replication. This requires certain permissions and a crafted query.

Original NVD description (English source)

Microsoft SQL Server 2008 SP3 and SP4, 2008 R2 SP2 and SP3, 2012 SP1 and SP2, and 2014 does not prevent use of uninitialized memory in certain attempts to execute virtual functions, which allows remote authenticated users to execute arbitrary code via a crafted query, aka "SQL Server Remote Code Execution Vulnerability."