CVE-2020-15603 Null dereference in Trend Micro Security (Consumer)
An attacker can cause a system crash in Trend Micro Security by triggering an invalid memory read in the driver.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-15603?
CVE-2020-15603 is a high-severity vulnerability in Trend Micro Security (Consumer), published on 15 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An invalid memory read vulnerability in a Trend Micro Secuity 2020 (v16.0.0.1302 and below) consumer family of products' driver could allow an attacker to manipulate the specific driver to do a system call operation with an invalid address, resulting in a potential system crash.
Weakness: CWE-125
Which versions are affected by CVE-2020-15603?
It affects 4 products.
Products include Trendmicro Antivirus\+ 2020, Trendmicro Internet Security 2020, Trendmicro Maximum Security 2020, Trendmicro Premium Security 2020.
How do I fix CVE-2020-15603?
No fix has been published for CVE-2020-15603 yet. Limit exposure of the affected software until one is available.
Is CVE-2020-15603 being exploited?
There is no known exploitation of CVE-2020-15603 in the wild and no public exploit code.
Other vulnerabilities in Trend Micro Security (Consumer)
Sources
Also known as GHSA-7fmj-8v6q-jrwf.