CVE-2017-0058
published 2017-04-12CVE-2017-0058: A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who…
PriorityP427medium4.7CVSS 3.0
AVLACHPRLUINSUCHINAN
EXPLOIT
EPSS
3.65%
89.0th percentile
A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability."
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
| microsoft_corporation | windows | — | — |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1511 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1703 | — | — |
| msrc | windows_7 | — | — |
| msrc | windows_8.1 | — | — |
| msrc | windows_rt_8.1 | — | — |
| msrc | windows_server_2008 | — | — |
| msrc | windows_server_2008_r2 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
| msrc | windows_vista_service_pack_2 | — | — |
| msrc | windows_vista_x64_edition_service_pack_2 | — | — |
CVSS provenance
nvdv3.04.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
vendor_msrc4.7MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Win32k Information Disclosure Vulnerability
vendor_msrc·2017-04-11·CVSS 4.7
CVE-2017-0058 [MEDIUM] Win32k Information Disclosure Vulnerability
Win32k Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
To exploit this vulnerability, an attacker would have to log on to an affected system and run a specially crafted application.
The security update addresses the vulnerability by correcting how win32k handles objects in memory.
Windows Kernel-Mode Drivers: Windows Kernel-Mode Drivers
Impact: Information Disclosure
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely
Reference: https://catalog.update.microsoft.c
GHSA
GHSA-chmg-4q84-rx8x: A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information
ghsa_unreviewed·2022-05-17
CVE-2017-0058 [MEDIUM] CWE-200 GHSA-chmg-4q84-rx8x: A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information
A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability."
No detection rules found.
No writeups or analysis indexed.
http://www.securityfocus.com/bid/97462http://www.securitytracker.com/id/1038239https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0058https://www.exploit-db.com/exploits/41879/http://www.securityfocus.com/bid/97462http://www.securitytracker.com/id/1038239https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0058https://www.exploit-db.com/exploits/41879/
2017-04-12
Published