CVE-2015-7865

CVSS V2 High 7.7 CVSS V3 None
Description
nvSCPAPISvr.exe in the Stereoscopic 3D Driver Service in the NVIDIA GPU graphics driver R340 before 341.92, R352 before 354.35, and R358 before 358.87 on Windows does not properly restrict access to the stereosvrpipe named pipe, which allows local users to gain privileges via a commandline in a number 2 command, which is stored in the HKEY_LOCAL_MACHINE explorer Run registry key, a different vulnerability than CVE-2011-4784.
Overview
  • CVE ID
  • CVE-2015-7865
  • Assigner
  • cve@mitre.org
  • Vulnerability Status
  • Analyzed
  • Published Version
  • 2015-11-24T20:59:11
  • Last Modified Date
  • 2019-02-13T21:10:10
Weakness Enumerations
CWE URL
CWE-284 http://cwe.mitre.org/data/definitions/284.html
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
AND
cpe:2.3:a:nvidia:gpu_driver:*:*:*:*:*:*:*:* 1 OR 340 341.92
cpe:2.3:a:nvidia:gpu_driver:*:*:*:*:*:*:*:* 1 OR 352 354.35
cpe:2.3:a:nvidia:gpu_driver:*:*:*:*:*:*:*:* 1 OR 358 358.87
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* 0 OR
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:A/AC:L/Au:S/C:C/I:C/A:C
  • Access Vector
  • ADJACENT_NETWORK
  • Access Compatibility
  • LOW
  • Authentication
  • SINGLE
  • Confidentiality Impact
  • COMPLETE
  • Integrity Impact
  • COMPLETE
  • Availability Impact
  • COMPLETE
  • Base Score
  • 7.7
  • Severity
  • HIGH
  • Exploitability Score
  • 5.1
  • Impact Score
  • 10
References
Reference URL Reference Tags
https://code.google.com/p/google-security-research/issues/detail?id=515 Exploit Mitigation Third Party Advisory
http://www.securitytracker.com/id/1034173 Third Party Advisory VDB Entry
http://nvidia.custhelp.com/app/answers/detail/a_id/3807/kw/security Vendor Advisory
https://h20565.www2.hp.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c04971867 Vendor Advisory
https://www.exploit-db.com/exploits/38792/ Third Party Advisory VDB Entry
http://packetstormsecurity.com/files/134520/NVIDIA-Stereoscopic-3D-Driver-Service-Arbitrary-Run-Key-Creation.html Third Party Advisory VDB Entry
Sources
Source Name Source URL
NIST https://nvd.nist.gov/vuln/detail/CVE-2015-7865
MITRE https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7865
History
Created Old Value New Value Data Type Notes
2022-05-10 07:58:44 Added to TrackCVE
2022-12-02 07:18:16 2015-11-24T20:59Z 2015-11-24T20:59:11 CVE Published Date updated
2022-12-02 07:18:16 2019-02-13T21:10:10 CVE Modified Date updated
2022-12-02 07:18:16 Analyzed Vulnerability Status updated