#VU7212 Information disclosure in Windows and Windows Server - CVE-2017-0286
Published: June 27, 2017 / Updated: September 14, 2018
Vulnerability identifier: #VU7212
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/U:Clear
CVE-ID: CVE-2017-0286
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerable software:
Windows
Windows Server
Windows
Windows Server
Software vendor:
Microsoft
Microsoft
Description
The vulnerability allows a remote attacker to obtain potentially sensitive information.
The weakness exists due to improper handling of objects in memory by the Windows GDI component. A remote attacker can trick the victim into visiting a specially crafted website and read arbitrary files on the system.
Successful exploitation of the vulnerability may result in information disclosure.
The weakness exists due to improper handling of objects in memory by the Windows GDI component. A remote attacker can trick the victim into visiting a specially crafted website and read arbitrary files on the system.
Successful exploitation of the vulnerability may result in information disclosure.
Remediation
Install update from vendor's website.