PT-2017-12265 · Microsoft · Windows 7+4

Published 2017-11-14 · Updated 2017-12-05 · CVE-2017-11832

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Windows 7 SP1 Windows Server 2008 SP2 Windows Server 2008 R2 SP1 Windows Server 2012

Description The issue concerns the Microsoft Windows embedded OpenType (EOT) font engine, which improperly handles specially crafted embedded fonts. This can allow an attacker to potentially read data that was not intended to be disclosed. The vulnerability enables attackers to obtain sensitive information and affect the system.

Recommendations For Windows 7 SP1, update the EOT font engine to a version that properly handles embedded fonts. For Windows Server 2008 SP2, apply the necessary patch to fix the EOT font engine parsing issue. For Windows Server 2008 R2 SP1, update the system to include the corrected EOT font engine. For Windows Server 2012, ensure the EOT font engine is updated to prevent the disclosure of sensitive information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-11832

Affected Products

Windows

Windows 7

Windows Server 2008

Windows Server 2008 R2

Windows Server 2012

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2017-11832 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-11832 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-11832 · Security Note
• https://osv.dev/vulnerability/CVE-2017-11832 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11832 · Vendor Advisory
• http://securitytracker.com/id/1039782 · Note
• http://securityfocus.com/bid/101726 · Note