CVE-2017-8696

CWE-119 — Buffer Overflow7 documents5 sources

Severity

7.5HIGH

EPSS

21.5%

top 4.29%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Live Meeting Microsoft Lync Microsoft Office WEB Apps +2 more

Timeline

PublishedSep 13

Latest updateMay 17

Description

Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an attacker to execute code remotely via a specially crafted website or a specially crafted document or email attachment, aka "Microsoft Graphics Component Remote Code Execution."

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages5 packages

▶NVDmicrosoft/lync2010, 2013+1

▶NVDmicrosoft/windowsr2

▶NVDmicrosoft/office_web_apps2010

▶NVDmicrosoft/live_meeting2007

▶NVDmicrosoft/skype2016

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-jf8w-75qw-9pq5: Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 a↗2022-05-17

▶

CVEList

CVE-2017-8696: Windows Uniscribe in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 a↗2017-09-13

▶

📋Vendor Advisories

Microsoft

Windows Uniscribe Remote Code Execution Vulnerability↗2017-09-12

▶

💬Community

Bugzilla

CVE-2016-8685 CVE-2016-8686 CVE-2016-8694 CVE-2016-8695 CVE-2016-8696 CVE-2016-8697 CVE-2016-8698 CVE-2016-8699 CVE-2016-8700 CVE-2016-8701 CVE-2016-8702 CVE-2016-8703 CVE-2017-7263 potrace: Multiple ↗2016-10-17

▶