CVSS: 5.0EPSS: 0%CPEs: 8EXPL: 1CVE-2017-8488 – Microsoft Windows - 'IOCTL_MOUNTMGR_QUERY_POINTS' Kernel Mountmgr Pool Memory Disclosure
https://notcve.org/view.php?id=CVE-2017-8488
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297. El kernel de Microsoft Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703 y Windows Server 2016 permite que un atacante autenticado obtenga información por medio de una aplicación especialmente creada. También se conoce como "Windows Kernel Information Disclosure Vulnerability," una vulnerabilidad diferente de los CVE-2017-8492, CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8485, CVE-2017-8483, CVE -2017-8482, CVE-2017-8480, CVE-2017-8479, CVE-2017-8478, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-8462, CVE-2017 -0300, CVE-2017-0299 y CVE-2017-0297. Microsoft Windows kernel has an issue where the handler of the IOCTL_MOUNTMGR_QUERY_POINTS IOCTL in mountmgr.sys discloses portions of uninitialized pool memory to user-mode clients, due to output structure alignment holes. • https://www.exploit-db.com/exploits/42212 http://www.securityfocus.com/bid/98864 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8488 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.7EPSS: 0%CPEs: 8EXPL: 0CVE-2017-8553 – Microsoft Windows XPS Document Writer Uninitialized Memory Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2017-8553
An information disclosure vulnerability exists in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows Server 2016 when the Windows kernel improperly handles objects in memory, aka "GDI Information Disclosure Vulnerability". Se presenta una vulnerabilidad de divulgación de información en Microsoft Windows Server 2008 SP2 y R2 SP1, Windows versión 8.1, Windows Server 2012 Gold y R2, Windows RT versión 8.1 y Windows Server 2016 cuando el kernel de Windows maneja de manera inapropiada los objetos en la memoria, también se conoce como "GDI Information Disclosure Vulnerability". This vulnerability allows local attackers to disclose sensitive information on vulnerable installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Microsoft XPS Document Writer. The issue results from the lack of proper initialization of memory prior to accessing it. • http://www.securityfocus.com/bid/98940 http://www.securitytracker.com/id/1038662 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8553 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 1CVE-2017-0289 – Microsoft Windows - 'USP10!otlValueRecord::adjustPos' Uniscribe Font Processing Out-of-Bounds Memory Read
https://notcve.org/view.php?id=CVE-2017-0289
Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Windows Graphics Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-8531, CVE-2017-8532, and CVE-2017-8533. Graphics en Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703 y Windows Server 2016 permiten la divulgación inadecuada del contenido de la memoria, aka Msgstr "Vulnerabilidad de divulgación de información de Graphics de Windows". Este CVE ID es exclusivo de CVE-2017-0286, CVE-2017-0287, CVE-2017-0288, CVE-2017-8531, CVE-2017-8532 y CVE-2017-8533. Microsoft Windows suffers from a Uniscribe font processing out-of-bounds memory read vulnerability in USP10! • https://www.exploit-db.com/exploits/42240 http://www.securityfocus.com/bid/98929 http://www.securitytracker.com/id/1038662 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0289 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 15EXPL: 1CVE-2017-0287 – Microsoft Windows - 'USP10!otlSinglePosLookup::getCoverageTable' Uniscribe Font Processing Out-of-Bounds Memory Read
https://notcve.org/view.php?id=CVE-2017-0287
Graphics in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows improper disclosure of memory contents, aka "Graphics Uniscribe Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-0286, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532, and CVE-2017-8533. Graphics en Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold y R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703 y Windows Server 2016 permiten la divulgación inadecuada del contenido de la memoria, aka Msgstr "Vulnerabilidad de divulgación de información de Graphics Uniscribe. Este CVE ID es exclusivo de CVE-2017-0286, CVE-2017-0288, CVE-2017-0289, CVE-2017-8531, CVE-2017-8532 y CVE-2017-8533. Microsoft Windows suffers from a Uniscribe font processing out-of-bounds memory read vulnerability in USP10! • https://www.exploit-db.com/exploits/42239 http://www.securityfocus.com/bid/98922 http://www.securitytracker.com/id/1038662 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0287 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.0EPSS: 0%CPEs: 13EXPL: 1CVE-2017-8462 – Microsoft Windows - 'nt!NtQueryVolumeInformationFile (FileFsVolumeInformation)' Kernel Pool Memory Disclosure
https://notcve.org/view.php?id=CVE-2017-8462
The kernel in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an authenticated attacker to obtain information via a specially crafted application. aka "Windows Kernel Information Disclosure Vulnerability," a different vulnerability than CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-0300, CVE-2017-0299, and CVE-2017-0297. El kernel de Microsoft Windows Server 2008 SP2 y R2 SP1, Windows 7 SP1, Windows versión 8.1, Windows Server 2012 Gold y R2, Windows RT versión 8.1, Windows 10 Gold, 1511, 1607, 1703 y Windows Server 2016 permite a un atacante autenticado conseguir información por medio de una aplicación creada se conoce también como "Windows Kernel Information Disclosure Vulnerability", este ID de CVE es una vulnerabilidad diferente de las CVE-2017-8491, CVE-2017-8490, CVE-2017-8489, CVE-2017-8488, CVE-2017-8485, CVE-2017-8483, CVE-2017-8482, CVE-2017-8481, CVE-2017-8480, CVE-2017-8478, CVE-2017-8479, CVE-2017-8476, CVE-2017-8474, CVE-2017-8469, CVE-2017-0300, CVE-2017-0299, y CVE-2017-0297. The Microsoft Windows kernel pool suffers from a memory disclosure in nt!NtQueryVolumeInformationFile (FileFsVolumeInformation). • https://www.exploit-db.com/exploits/42218 http://www.securityfocus.com/bid/98900 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8462 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •