Synopsis
The remote Windows host is affected multiple vulnerabilities.
Description
The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :
- An information disclosure vulnerability exists in a Windows Crypto driver running in kernel mode due to improper handling of objects in memory. A local attacker can exploit this, via a specially crafted application, to disclose sensitive information. (CVE-2016-7219)
- An elevation of privilege vulnerability exists in the Windows installer due to improper sanitization of input, leading to insecure library loading behavior. A local attacker can exploit this to run arbitrary code with elevated system privileges. (CVE-2016-7292)
Solution
Microsoft has released a set of patches for Windows Vista, 2008, 7, 2008 R2, 2012, 8.1, RT 8.1, 2012 R2, 10, and 2016.