Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-0063 — Sensitive Information Exposure in Corporation Color Management

CWE-200 — Sensitive Information Exposure6 documents4 sources
Severity
6.5MEDIUMNVD
NVD5.3
EPSS
16.3%
top 5.15%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
16
Microsoft Corporation Color ManagementMicrosoft Windows 10Microsoft Windows Server 2008+13 more
Timeline
PublishedMar 17
Latest updateMay 17

Description

The Color Management Module (ICM32.dll) memory handling functionality in Windows Vista SP2; Windows Server 2008 SP2 and R2; and Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to bypass ASLR and execute code in combination with another vulnerability through a crafted website, aka "Microsoft Color Management Information Disclosure Vulnerability." This vulnerability is different from that …

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages15 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-ghj3-wcfw-j5vr: The Color Management Module (ICM32↗2022-05-17
▶
GHSA
GHSA-vf7c-cc99-62w4: The Color Management Module (ICM32↗2022-05-17
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Color Management Module 'icm32.dll' - 'icm32!LHCalc3toX_Di16_Do16_Lut8_G32' Out-of-Bounds Read (MS17-013)↗2017-03-20
▶

📋Vendor Advisories

1
Microsoft
Microsoft Color Management Information Disclosure Vulnerability↗2017-03-14
▶