CVE-2018-10506: A out-of-bounds read information disclosure vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to disclose sensitive…

PriorityP419medium4.7CVSS 3.0

AVLACHPRLUINSUCHINAN

EPSS

1.08%

60.8th percentile

A out-of-bounds read information disclosure vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow a local attacker to disclose sensitive information on vulnerable installations due to a flaw within the processing of IOCTL 0x220004 by the TMWFP driver. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.

Affected

5 ranges

Vendor	Product	Version range	Fixed in
the_openjpeg_project	openjpeg2	>= 0 < 2.1.2-1.1+deb9u6ubuntu0.1~esm1	2.1.2-1.1+deb9u6ubuntu0.1~esm1
the_openjpeg_project	openjpeg2	>= 0 < 2.3.0-2ubuntu0.1~esm1	2.3.0-2ubuntu0.1~esm1
trend_micro	trend_micro_officescan	—	—
trendmicro	officescan	—	—
trendmicro	officescan	—	—

CVSS provenance

nvdv3.04.7MEDIUMCVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N

osv6.5MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.