CVE-2011-1229 win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1...
HighCVSS 7.2
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows local users to gain privileges via a crafted application that triggers a NULL pointer dereference, a different vulnerability than other "Vulnerability Type 2" CVEs listed in MS11-034, aka "Win32k Null Pointer De-reference Vulnerability."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft windows 2003 server | All versions | No fix listed |
| Microsoft windows 7 | All versions | No fix listed |
| Microsoft windows server 2003 | All versions | No fix listed |
| Microsoft windows server 2008 | All versions | No fix listed |
| Microsoft windows server 2008 | = r2 | No fix listed |
| Microsoft windows server 2008 | = r2-sp1 | No fix listed |
| Microsoft windows vista | All versions | No fix listed |
| Microsoft windows xp | All versions | No fix listed |
| avaya agent access | All versions | No fix listed |
| avaya aura conferencing standard edition | = 6.0.0 | No fix listed |
| avaya basic call management system reporting desktop | All versions | No fix listed |
| avaya call management server supervisor | All versions | No fix listed |
| avaya callpilot | >= 4.0.x, <= 5.0.x | No fix listed |
| avaya callvisor asai lan | All versions | No fix listed |
| avaya communication server 1000 telephony manager | >= 3.0.0, <= 4.0.0 | No fix listed |
| avaya computer telephony | All versions | No fix listed |
| avaya contact center express | All versions | No fix listed |
| avaya customer interaction express | All versions | No fix listed |
| avaya enterprise manager | All versions | No fix listed |
| avaya integrated management | All versions | No fix listed |
| avaya interaction center | All versions | No fix listed |
| avaya ip agent | All versions | No fix listed |
| avaya ip softphone | All versions | No fix listed |
| avaya meeting exchange | >= 5.0.0, <= 5.2.0 | No fix listed |
| avaya messaging application server | >= 4.0.x, <= 5.2.x | No fix listed |
Show 12 more
| Product | Affected versions | Fixed in |
|---|---|---|
| avaya network reporting | All versions | No fix listed |
| avaya octelaccess server | All versions | No fix listed |
| avaya octeldesigner | All versions | No fix listed |
| avaya operational analyst | All versions | No fix listed |
| avaya outbound contact management | All versions | No fix listed |
| avaya speech access | All versions | No fix listed |
| avaya unified communication center | All versions | No fix listed |
| avaya unified messenger | All versions | No fix listed |
| avaya visual messenger | All versions | No fix listed |
| avaya visual vector client | All versions | No fix listed |
| avaya vpnmanager console | All versions | No fix listed |
| avaya web messenger | All versions | No fix listed |
References
- blogs.technet.com vendor-advisory
- 71735 broken-link vdb-entry
- 44156 third-party-advisory
- support.avaya.com third-party-advisory
- 47229 third-party-advisory vdb-entry
- 1025345 third-party-advisory vdb-entry
- TA11-102A third-party-advisory us-government-resource
- ADV-2011-0952 broken-link vdb-entry
- MS11-034 patch vendor-advisory
- mswin-win32k-var17-priv-escalation(66411) vdb-entry
- oval:org.mitre.oval:def:12503 signature third-party-advisory vdb-entry