5.5med
CVE-2017-11934
Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an information disclosure vulnerability due to the…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
12.6%
percentile 96%
Public exploits
0
none known
Summary
Microsoft Office 2013 RT SP1, Microsoft Office 2013 SP1, and Microsoft Office 2016 allow an information disclosure vulnerability due to the way certain functions handle objects in memory, aka "Microsoft Office Information Disclosure Vulnerability".
Exploit prediction (EPSS)
12.59% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected products
- Microsoft Corporation Microsoft Office
Classification
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
- securitytracker.com /id/1039998 · vdb-entry, x_refsource_SECTRACK, x_transferred
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-11934 · x_refsource_CONFIRM, x_transferred
- securityfocus.com /bid/102064 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-11934
- NVD: CVE-2017-11934
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.