CVE-2019-1365

State: Published
Severity: Not scored
Published: Oct 10, 2019
Updated: Aug 4, 2024
Reserved: Nov 26, 2018

Description

An elevation of privilege vulnerability exists when Microsoft IIS Server fails to check the length of a buffer prior to copying memory to it.An attacker who successfully exploited this vulnerability can allow an unprivileged function ran by the user to execute code in the context of NT AUTHORITY\system escaping the Sandbox.The security update addresses the vulnerability by correcting how Microsoft IIS Server sanitizes web requests., aka 'Microsoft IIS Server Elevation of Privilege Vulnerability'.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
WindowsMicrosoft	7 for 32-bit Systems Service Pack 1Affected 7 for x64-based Systems Service Pack 1Affected 8.1 for 32-bit systemsAffected 8.1 for x64-based systemsAffected RT 8.1Affected 10 Version 1607 for 32-bit SystemsAffected 10 Version 1607 for x64-based SystemsAffected 10 Version 1803 for 32-bit SystemsAffected 10 Version 1803 for x64-based SystemsAffected 10 Version 1803 for ARM64-based SystemsAffected 10 Version 1809 for 32-bit SystemsAffected 10 Version 1809 for x64-based SystemsAffected 10 Version 1809 for ARM64-based SystemsAffected
Windows ServerMicrosoft	2008 R2 for x64-based Systems Service Pack 1 (Core installation)Affected 2008 R2 for Itanium-Based Systems Service Pack 1Affected 2008 R2 for x64-based Systems Service Pack 1Affected 2008 for 32-bit Systems Service Pack 2 (Core installation)Affected 2012Affected 2012 (Core installation)Affected 2012 R2Affected 2012 R2 (Core installation)Affected 2016Affected 2016 (Core installation)Affected version 1803 (Core Installation)Affected 2019Affected 2019 (Core installation)Affected 2008 for Itanium-Based Systems Service Pack 2Affected 2008 for 32-bit Systems Service Pack 2Affected 2008 for x64-based Systems Service Pack 2Affected 2008 for x64-based Systems Service Pack 2 (Core installation)Affected
Windows 10 Version 1903 for 32-bit SystemsMicrosoft	unspecifiedAffected
Windows 10 Version 1903 for x64-based SystemsMicrosoft	unspecifiedAffected
Windows 10 Version 1903 for ARM64-based SystemsMicrosoft	unspecifiedAffected
Windows Server, version 1903 (Server Core installation)Microsoft	unspecifiedAffected

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1365

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.