CVE-2017-8582
published 2017-07-11CVE-2017-8582: HTTP.sys in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511…
PriorityP434medium5.9CVSS 3.0
AVNACHPRNUINSUCHINAN
EPSS
8.29%
94.3th percentile
HTTP.sys in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when the component improperly handles objects in memory, aka "Https.sys Information Disclosure Vulnerability".
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2012 | — | — |
| msrc | windows_10 | — | — |
| msrc | windows_10_version_1511 | — | — |
| msrc | windows_10_version_1607 | — | — |
| msrc | windows_10_version_1703 | — | — |
| msrc | windows_7 | — | — |
| msrc | windows_8.1 | — | — |
| msrc | windows_rt_8.1 | — | — |
| msrc | windows_server_2008 | — | — |
| msrc | windows_server_2008_r2 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
CVSS provenance
nvdv3.05.9MEDIUMCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_msrc5.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Http.sys Information Disclosure Vulnerability
vendor_msrc·2017-07-11·CVSS 5.9
CVE-2017-8582 [MEDIUM] Http.sys Information Disclosure Vulnerability
Http.sys Information Disclosure Vulnerability
Description: An Information Disclosure vulnerability exists when the HTTP.sys server application component improperly handles objects in memory.
An attacker who successfully exploited this vulnerability could obtain information to further compromise the HTTP.sys server application system.
A remote unauthenticated attacker could exploit this vulnerability by issuing a request to the HTTP.sys server application.
The update addresses the vulnerability by correcting how the HTTP.sys server application handles objects in memory.
ASP .NET: ASP .NET
Impact: Information Disclosure
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely;Older Software Release:Exploitation Unlikely;DOS:N/A
Reference: https://
GHSA
GHSA-j86w-pv3h-q25q: HTTP
ghsa_unreviewed·2022-05-17
CVE-2017-8582 [MEDIUM] CWE-200 GHSA-j86w-pv3h-q25q: HTTP
HTTP.sys in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when the component improperly handles objects in memory, aka "Https.sys Information Disclosure Vulnerability".
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/99429http://www.securitytracker.com/id/1038863https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8582http://www.securityfocus.com/bid/99429http://www.securitytracker.com/id/1038863https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8582
2017-07-11
Published