CVE-2017-0039 — Corporation Windows DLL vulnerability

10 documents5 sources

Severity

7.8HIGHNVD

EPSS

10.3%

top 6.78%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Corporation Windows DLL Msrc Windows 7 FOR 32-bit Systems Service Pack 1 Msrc Windows 7 FOR X64-based Systems Service Pack 1 +7 more

Timeline

PublishedMar 17

Latest updateMay 13

Description

Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages10 packages

▶msrcmsrc/windows_server_2008_for_32-bit_systems_service_pack_2

▶msrcmsrc/windows_server_2008_for_x64-based_systems_service_pack_2

▶msrcmsrc/windows_server_2008_r2_for_x64-based_systems_service_pack_1

▶msrcmsrc/windows_server_2008_for_itanium-based_systems_service_pack_2

▶msrcmsrc/windows_server_2008_r2_for_itanium-based_systems_service_pack_1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-crhq-jv39-3hgh: Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle dynamic link library (DLL) loading, which allows local users to gain privileges via a crafte↗2022-05-13

▶

📋Vendor Advisories

Microsoft

Windows DLL Loading Remote Code Execution Vulnerability↗2017-03-14

▶