PT-2017-18370 · Microsoft · Windows Server 2016+9
Published
2017-07-11
·
Updated
2017-07-17
·
CVE-2017-8486
CVSS v3.1
4.7
Medium
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows versions 7 SP1, 8.1, 10 Gold, 1511, 1607, 1703
Microsoft Windows Server versions 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016
Windows RT 8.1
Description
The issue allows attackers to obtain sensitive information and affect the system due to the way it handles objects in memory. This is related to an out-of-bounds read information disclosure in the win32kfull CopyOutputString.
Recommendations
For Microsoft Windows versions 7 SP1, 8.1, 10 Gold, 1511, 1607, 1703, update to a version that includes the fix for the information disclosure issue.
For Microsoft Windows Server versions 2008 SP2, 2008 R2 SP1, 2012, 2012 R2, 2016, update to a version that includes the fix for the information disclosure issue.
For Windows RT 8.1, update to a version that includes the fix for the information disclosure issue.
As a temporary workaround, consider restricting access to sensitive information until a patch is available.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Windows
Windows 10
Windows 7
Windows 8.1
Windows Rt 8.1
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016