CVE-2017-0188 — Sensitive Information Exposure in Corporation Windows

CWE-200 — Sensitive Information Exposure8 documents5 sources
Severity
7.8HIGHNVD
NVD3.3
EPSS
5.1%
top 10.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
17
Microsoft Corporation WindowsMicrosoft Windows 10Microsoft Windows Server 2012+14 more
Timeline
PublishedApr 12
Latest updateMay 17

Description

A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-0189.

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages17 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g9w7-8hcr-36c9: A Win32k information disclosure vulnerability exists in Windows 8↗2022-05-17
▶
GHSA
GHSA-gm7p-c8p7-9785: An elevation of privilege vulnerability exists in Windows 10 when the Windows kernel-mode driver fails to properly handle objects in memory↗2022-05-13
▶

📋Vendor Advisories

1
Microsoft
Win32k Information Disclosure Vulnerability↗2017-04-11
▶

🕵️Threat Intelligence

3
Talos
Microsoft Patch Tuesday - April 2017↗2017-04-12
▶
Talos
Microsoft Patch Tuesday - April 2017↗2017-04-12
▶
Zscaler
Zscaler protects against 16 new vulnerabilities for MS↗
▶
CVE-2017-0188 — Sensitive Information Exposure | cvebase