CVE-2017-0188

EUVD-2017-0555

12.04.2017, 14:59

A Win32k information disclosure vulnerability exists in Windows 8.1, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10, and Windows Server 2016 when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability." This CVE ID is unique from CVE-2017-0189.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	3.3 LOW	LOCAL	LOW	LOW	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 89%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_10	*
microsoft	windows_8.1	*
microsoft	windows_rt_8.1	-
microsoft	windows_server_2012	*
microsoft	windows_server_2016	*

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB4015221
1511 (x64, x86)	KB4015219
1607 (x64, x86)	KB4015217
1703 (x64, x86)	KB4015583

Windows 8.1

(x64, x86)

KB4015550

Windows RT 8.1

All

KB4015550

Windows Server 2012

Server Core	KB4015551
Standard	KB4015551

Windows Server 2012 R2

Server Core	KB4015550
Standard	KB4015550

Windows Server 2016

Server Core	KB4015217
Standard	KB4015217

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://www.securityfocus.com/bid/97475

http://www.securitytracker.com/id/1038239

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0188

http://www.securityfocus.com/bid/97475

http://www.securitytracker.com/id/1038239

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0188