CVE-2017-8676

CWE-200 — Information Exposure4 documents4 sources

Severity

3.3LOW

EPSS

7.6%

top 8.15%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Corporation Windows Graphics Device Interface (gdi)Microsoft Live Meeting Microsoft Lync +5 more

Timeline

PublishedSep 13

Latest updateMay 17

Description

The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a spe…

CVSS vector

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.8 | Impact: 1.4

Affected Packages7 packages

▶CVEListV5microsoft_corporation/windows_graphics_device_interface_(gdi)15 versions+14

▶NVDmicrosoft/windowsr2

▶NVDmicrosoft/windows_101511, 1607, 1703+2

▶NVDmicrosoft/lync2010, 2013+1

▶NVDmicrosoft/office2011, 2016+1

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-grmq-j248-v2cj: The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8↗2022-05-17

▶

CVEList

CVE-2017-8676: The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8↗2017-09-13

▶

📋Vendor Advisories

Microsoft

Windows GDI+ Information Disclosure Vulnerability↗2017-09-12

▶