CVE-2017-11852 — Sensitive Information Exposure in Corporation GDI

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
4.7MEDIUMNVD
EPSS
4.1%
top 11.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
9
Microsoft Corporation GDIMicrosoft Windows Server 2008Msrc Windows 7 FOR 32-bit Systems Service Pack 1+6 more
Timeline
PublishedNov 15
Latest updateMay 17

Description

Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run a specially crafted application to compromise the user's system, due improperly disclosing kernel memory addresses, aka "Windows GDI Information Disclosure Vulnerability".

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.0 | Impact: 3.6

Affected Packages9 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-44x3-96q8-6c96: Microsoft GDI Component in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to log on to an affected system and run a specially↗2022-05-17
▶

📋Vendor Advisories

1
Microsoft
Windows GDI Information Disclosure Vulnerability↗2017-11-14
▶

🕵️Threat Intelligence

1
Talos
Microsoft Patch Tuesday - November 2017↗2017-11-14
▶