CVE-2017-0038

EUVD-2017-0405

20.02.2017, 16:59

gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process heap memory via a crafted EMF file, as demonstrated by an EMR_SETDIBITSTODEVICE record with modified Device Independent Bitmap (DIB) dimensions. NOTE: this vulnerability exists because of an incomplete fix for CVE-2016-3216, CVE-2016-3219, and/or CVE-2016-3220.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.5 MEDIUM	LOCAL	LOW	NONE	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_10	-
microsoft	windows_7	*
microsoft	windows_8.1	*
microsoft	windows_rt_8.1	*
microsoft	windows_server_2008	*
microsoft	windows_server_2012	-
microsoft	windows_server_2016	*
microsoft	windows_vista	*

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB4012606
1511 (x64, x86)	KB4013198
1607 (x64, x86)	KB4013429

Windows 7

Service Pack 1 (x64, x86)

KB4012215

Windows 8.1

(x64, x86)

KB4012216

Windows RT 8.1

All

KB4012216

Windows Server 2008

Service Pack 2 (x64, x86)	KB4017018
Service Pack 2 Server Core (x64, x86)	KB4017018

Windows Server 2008 R2

Service Pack 1 (x64)	KB4012215
Service Pack 1 Server Core (x64)	KB4012215

Windows Server 2012

Server Core	KB4012217
Standard	KB4012217

Windows Server 2012 R2

Server Core	KB4012216
Standard	KB4012216

Windows Server 2016

Server Core	KB4013429
Standard	KB4013429

Windows Vista

Service Pack 2	KB4017018
x64 Edition	KB4017018

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://www.securityfocus.com/bid/96023

http://www.securitytracker.com/id/1037845

https://0patch.blogspot.com/2017/02/0patching-0-day-windows-gdi32dll-memory.html

https://bugs.chromium.org/p/project-zero/issues/detail?id=992

https://github.com/k0keoyo/CVE-2017-0038-EXP-C-JS

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0038