Information disclosure in Microsoft Windows and Windows Server - CVE-2017-0123

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to improper disclosure of memory contents in Windows Uniscribe. A remote unauthenticated attacker can trick the victim into opening a specially crafted document or visiting a malformed web page and gain access to potentially sensitive information.

Successful exploitation of this vulnerability may allow an attacker to gain access to potentially sensitive data.

Affected software

How to mitigate CVE-2017-0123

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

• Exploit #1114 - Microsoft Windows - Uniscribe Font Processing Multiple Heap-Based Out-of-Bounds and Wild Reads (MS17-011) (March 18, 2020)

External References

• https://technet.microsoft.com/en-us/library/security/MS17-011

Related Security Bulletins

• Multiple vulnerabilities in Microsoft Uniscribe
• Windows Uniscribe Information Disclosure Vulnerability