SQL RDBMS Engine Elevation of Privilege Vulnerability
CVE-2016-7254 is fixed in 8 products on 1 platform, first by KB3194725, released May 27, 2020. It is not reported as exploited. Patch Radar priority: High.
<p>An elevation of privilege vulnerability exists in Microsoft SQL Server when it improperly handles pointer casting. An attacker could exploit the vulnerability if the attacker's credentials allow access to an affected SQL server database.</p> <p>An attacker who successfully exploited this vulnerability could gain elevated privileges that could be used to view, change, or delete data; or create new accounts.</p> <p>The security update addresses the vulnerability by correcting how SQL Server handles pointer casting.</p>
Where it's fixed
| Product | Fixed in | Fix | Released |
|---|---|---|---|
| Microsoft | |||
| Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2 (CU) | KB3194725 | May 27, 2020 | |
| Microsoft SQL Server 2012 for 32-bit Systems Service Pack 2 (GDR) | KB3194719 | May 27, 2020 | |
| Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3 (GDR) | KB3194721 | May 27, 2020 | |
| Microsoft SQL Server 2012 for 32-bit Systems Service Pack 3 (CU) | KB3194724 | May 27, 2020 | |
| Microsoft SQL Server 2012 for x64-based Systems Service Pack 2 (CU) | KB3194725 | May 27, 2020 | |
| Microsoft SQL Server 2012 for x64-based Systems Service Pack 2 (GDR) | KB3194719 | May 27, 2020 | |
| Microsoft SQL Server 2012 for x64-based Systems Service Pack 3 (CU) | KB3194724 | May 27, 2020 | |
| Microsoft SQL Server 2012 for x64-based Systems Service Pack 3 (GDR) | KB3194721 | May 27, 2020 | |
Patch Radar data is free to use with attribution. Terms and how to credit it.
Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.