Vulnerability Details : CVE-2017-8676
The Windows Graphics Device Interface (GDI) in Microsoft Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, 1607, 1703, and Server 2016; Office 2007 SP3; Office 2010 SP2; Word Viewer; Office for Mac 2011 and 2016; Skype for Business 2016; Lync 2013 SP1; Lync 2010; Lync 2010 Attendee; and Live Meeting 2007 Add-in and Console allows an authenticated attacker to retrieve information from a targeted system via a specially crafted application, aka "Windows GDI+ Information Disclosure Vulnerability."
Vulnerability category: Information leak
Products affected by CVE-2017-8676
- cpe:2.3:a:microsoft:office:2011:*:mac:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2016:*:mac:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:lync:2010:*:attendee:*:*:*:*:*
- cpe:2.3:a:microsoft:lync:2010:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:lync:2013:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:live_meeting:2007:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:skype_for_business:2016:*:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_2007:*:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office_2010:*:sp2:*:*:*:*:*:*
Threat overview for CVE-2017-8676
Top countries where our scanners detected CVE-2017-8676
Top open port discovered on systems with this issue
443
IPs affected by CVE-2017-8676 1,421
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2017-8676!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2017-8676
9.19%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 95 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-8676
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
2.1
|
LOW | AV:L/AC:L/Au:N/C:P/I:N/A:N |
3.9
|
2.9
|
NIST | |
|
3.3
|
LOW | CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N |
1.8
|
1.4
|
NIST |
CWE ids for CVE-2017-8676
-
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-8676
-
http://www.securityfocus.com/bid/100755
Microsoft Windows Graphics Device Interface CVE-2017-8676 Local Information Disclosure VulnerabilityThird Party Advisory;VDB Entry
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8676
CVE-2017-8676 | Windows GDI+ Information Disclosure VulnerabilityPatch;Vendor Advisory
-
http://www.securitytracker.com/id/1039333
Microsoft GDI+ Flaw Lets Local Users Obtain Potentially Sensitive Information on the Target System - SecurityTrackerThird Party Advisory;VDB Entry
Jump to