Vulmon Recent Vulnerabilities Research Posts Trends Blog About Contact
7.2
CVSSv2

CVE-2010-1897

Published: 11/08/2010 Updated: 07/12/2023
CVSS v2 Base Score: 7.2 | Impact Score: 10 | Exploitability Score: 3.9
VMScore: 725
Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C
Subscribe to Microsoft

Vulnerability Summary

The Windows kernel-mode drivers in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 do not properly validate pseudo-handle values in callback parameters during window creation, which allows local users to gain privileges via a crafted application, aka "Win32k Window Creation Vulnerability."

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows server 2008

microsoft windows server 2008 -

microsoft windows xp -

microsoft windows 7 -

microsoft windows vista -

microsoft windows xp

microsoft windows 7

microsoft windows vista

microsoft windows server 2003

microsoft windows 2003 server

Exploits

Exploit DB: Microsoft Windows - CreateWindow Function Callback (MS10-048)
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Core Security Technologies - CoreLabs Advisory corelabscoresecuritycom/ Microsoft Windows CreateWindow function callback vulnerability 1 *Advisory Information* Title: Microsoft Windows CreateWindow function callback vulnerability Advisory Id: CORE-2010-0623 Advisory URL: ...
Exploit DB: Core Security Technologies Advisory 2010.0623
Core Security Technologies Advisory - A crash due to an invalid read in the Windows kernel can be reliably leveraged into privileged code execution resulting in a privilege escalation local vulnerability This happens because special values of 'hParent' where not sufficiently taken into account when patching 'xxxCreateWindowsEx' on MS010-032 ...

References

CWE-20http://www.us-cert.gov/cas/techalerts/TA10-222A.htmlhttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11663https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-048https://nvd.nist.govhttps://www.exploit-db.com/exploits/14608/
CVSSv2
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2022-48700CVE-2022-48689CVE-2024-27956CVE-2023-6363SQLNULL pointer dereferenceCVE-2023-41830CVE-2015-2051arbitrary
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started

Vulmon Search

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

About

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Products

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Connect

Twitter Reddit Linkedin Facebook