Main Vulnerability Database Vulnerabilities #VU8305

Information disclosure in Microsoft Windows and Windows Server - CVE-2017-8684

Published: September 12, 2017 / Updated: September 14, 2018

Vulnerability identifier: #VU8305

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-8684

CWE-ID: CWE-200

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local user to obtain potentially sensitive information.

An information disclosure vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in memory, allowing an attacker to retrieve information from a targeted system. A local user can gain access to potentially sensitive information.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2017-8684

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #1322 - Microsoft Windows Kernel - 'win32k!NtGdiGetFontResourceInfoInternalW' Stack Memory Disclosure (March 18, 2020)

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8684

Related Security Bulletins

Information disclosure in Microsoft Windows GDI