The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI+ Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0062.
References
| Link | Resource |
|---|---|
| http://www.securityfocus.com/bid/96713 | Broken Link Third Party Advisory VDB Entry |
| http://www.securitytracker.com/id/1038002 | Broken Link Third Party Advisory VDB Entry |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0060 | Patch Vendor Advisory |
| https://www.exploit-db.com/exploits/41656/ | Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
31 Mar 2023, 18:31
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* |
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* cpe:2.3:a:microsoft:skype_for_business_basic:2016:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:* cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:* cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:* cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_vista:-:sp2:*:*:*:*:x64:* cpe:2.3:a:microsoft:lync:2010:*:*:*:attendee:*:*:* cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:* cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* |
| CVSS |
v2 : v3 : |
v2 : 2.1
v3 : 5.5 |
| First Time |
Microsoft lync
Microsoft live Meeting Microsoft skype For Business Basic Microsoft skype For Business Microsoft office Microsoft windows Server 2016 Microsoft office Word Viewer |
|
| References | (SECTRACK) http://www.securitytracker.com/id/1038002 - Broken Link, Third Party Advisory, VDB Entry | |
| References | (BID) http://www.securityfocus.com/bid/96713 - Broken Link, Third Party Advisory, VDB Entry | |
| References | (EXPLOIT-DB) https://www.exploit-db.com/exploits/41656/ - Third Party Advisory, VDB Entry |
Information
Published : 2017-03-17 00:59
Updated : 2023-12-10 12:01
NVD link : CVE-2017-0060
Mitre link : CVE-2017-0060
CVE.ORG link : CVE-2017-0060
JSON object : View
Products Affected
microsoft
- live_meeting
- skype_for_business
- skype_for_business_basic
- windows_7
- windows_rt_8.1
- windows_server_2016
- office
- lync
- windows_vista
- office_word_viewer
- windows_server_2008
- windows_server_2012
- windows_10
- windows_8.1
CWE
CWE-200
Exposure of Sensitive Information to an Unauthorized Actor