Information disclosure in Microsoft products - CVE-2017-8676
Published: September 12, 2017 / Updated: September 12, 2017
Vulnerability identifier: #VU8303
CSH Severity: Low
CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-8676
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to obtain potentially sensitive information.
An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. A local user can gain access to potentially sensitive information.
Affected software
Microsoft Word
Microsoft Office
Microsoft Office for macOS
Microsoft Windows
Windows Server
Microsoft Live Meeting
Microsoft Lync
Lync Attendee
Skype for Business
Microsoft Office
Microsoft Office for macOS
Microsoft Windows
Windows Server
Microsoft Live Meeting
Microsoft Lync
Lync Attendee
Skype for Business
How to mitigate CVE-2017-8676
Install updates from vendor's website.