PT-2017-12265 · Microsoft · Windows 7+4

Publicado 2017-11-14 · Atualizado 2017-12-05 · CVE-2017-11832

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Média

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows 7 SP1 Windows Server 2008 SP2 Windows Server 2008 R2 SP1 Windows Server 2012

Description The issue concerns the Microsoft Windows embedded OpenType (EOT) font engine, which improperly handles specially crafted embedded fonts. This can allow an attacker to potentially read data that was not intended to be disclosed. The vulnerability enables attackers to obtain sensitive information and affect the system.

Recommendations For Windows 7 SP1, update the EOT font engine to a version that properly handles embedded fonts. For Windows Server 2008 SP2, apply the necessary patch to fix the EOT font engine parsing issue. For Windows Server 2008 R2 SP1, update the system to include the corrected EOT font engine. For Windows Server 2012, ensure the EOT font engine is updated to prevent the disclosure of sensitive information.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-11832

Produtos afetados

Windows

Windows 7

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

Referências · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-11832 · Nota de Segurança
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-11832 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11832 · Nota de Segurança
• http://securitytracker.com/id/1039782 · Nota
• https://osv.dev/vulnerability/CVE-2017-11832 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11832 · Aviso do Fabricante
• http://securityfocus.com/bid/101726 · Nota