CVE-2017-0121

EUVD-2017-0488

17.03.2017, 00:59

Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Uniscribe Information Disclosure Vulnerability." CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	4.3 MEDIUM	NETWORK	LOW	NONE	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 93%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_10	-
microsoft	windows_7	*
microsoft	windows_8.1	*
microsoft	windows_rt_8.1	*
microsoft	windows_server_2008	*
microsoft	windows_server_2012	-
microsoft	windows_server_2016	*
microsoft	windows_vista	*

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB4012606
1511 (x64, x86)	KB4013198
1607 (x64, x86)	KB4013429

Windows 7

Service Pack 1 (x64, x86)

KB4012215

Windows 8.1

(x64, x86)

KB4012216

Windows RT 8.1

All

KB4012216

Windows Server 2008

Service Pack 2 (x64, x86)	KB4012583
Service Pack 2 Server Core (x64, x86)	KB4012583

Windows Server 2008 R2

Service Pack 1 (x64)	KB4012215
Service Pack 1 Server Core (x64)	KB4012215

Windows Server 2012

Server Core	KB4012217
Standard	KB4012217

Windows Server 2012 R2

Server Core	KB4012216
Standard	KB4012216

Windows Server 2016

Server Core	KB4013429
Standard	KB4013429

Windows Vista

Service Pack 2	KB4012583
x64 Edition	KB4012583

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://www.securityfocus.com/bid/96678

http://www.securitytracker.com/id/1037992

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0121

https://www.exploit-db.com/exploits/41655/

http://www.securityfocus.com/bid/96678

http://www.securitytracker.com/id/1037992

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0121

https://www.exploit-db.com/exploits/41655/