CVE-2018-8427 : An information disclosure vulnerability exists in the way that Microsoft Graphic

An information disclosure vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka "Microsoft Graphics Components Information Disclosure Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Office 365 ProPlus, Windows Server 2008, Microsoft PowerPoint Viewer, Microsoft Excel Viewer.

Published 2018-10-10 13:29:02

Updated 2018-11-27 16:04:59

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2018-8427

Microsoft » Office » Version: 2016 For Mac Os X
cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os_x:*:*
Matching versions
Microsoft » Office » Version: 2019
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
Matching versions
Microsoft » Excel Viewer » Version: 2007 Update SP3
cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2008 » Version: N/A Update SP2
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack » Version: N/A Update SP3
cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Word Viewer » Version: N/A
cpe:2.3:a:microsoft:office_word_viewer:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Powerpoint Viewer » Version: 2007
cpe:2.3:a:microsoft:powerpoint_viewer:2007:*:*:*:*:*:*:*
Matching versions
Microsoft » Office 365 Proplus » Version: N/A
cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-8427

EPSS FAQ

0.24%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 62 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-8427

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
2.1	LOW	AV:L/AC:L/Au:N/C:P/I:N/A:N	3.9	2.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: None Availability: None

CWE ids for CVE-2018-8427

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2018-8427

http://www.securityfocus.com/bid/105453

Microsoft Windows Graphics Component CVE-2018-8427 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8427

CVE-2018-8427 | Microsoft Graphics Components Information Disclosure Vulnerability
Patch;Vendor Advisory
http://www.securitytracker.com/id/1041823

Microsoft GDI+ Multiple Bugs Lets Local Users Gain Potentially Sensitive Information and Obtain Elevated Privileges - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2018-8427

Products affected by CVE-2018-8427

Exploit prediction scoring system (EPSS) score for CVE-2018-8427

CVSS scores for CVE-2018-8427

CWE ids for CVE-2018-8427

References for CVE-2018-8427