5.5med
CVE-2017-11835
Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intende…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.4%
percentile 84%
Public exploits
0
none known
Summary
Microsoft graphics in Windows 7 SP1 and Windows Server 2008 SP2 and R2 SP1 allows an attacker to potentially read data that was not intended to be disclosed due to the way that the Microsoft Windows Embedded OpenType (EOT) font engine parses specially crafted embedded fonts, aka "Windows EOT Font Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11832.
Exploit prediction (EPSS)
2.38% probability of exploitation in the next 30 days, higher than 84% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 2.1 | AV:L/AC:L/Au:N/C:P/I:N/A:N |
Affected products
- Microsoft Corporation Microsoft Graphics
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- securityfocus.com /bid/101736 · vdb-entry, x_refsource_BID, x_transferred
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-11835 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039782 · vdb-entry, x_refsource_SECTRACK, x_transferred
Sources
- CVE List: CVE-2017-11835
- NVD: CVE-2017-11835
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.