CVE-2016-7257

MEDIUM

Microsoft Office For Mac - Information Disclosure

Title source: rule

Description

The GDI component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office for Mac 2011, and Office 2016 for Mac allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI Information Disclosure Vulnerability."

References (5)

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/94755

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1037438

[Third Party Advisory, VDB Entry] http://www.securitytracker.com/id/1037441

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-146

[Vendor Advisory] https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-148

Scores

CVSS v3 6.5

EPSS 0.1329

EPSS Percentile 94.1%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Classification

CWE

CWE-200

Status published

Affected Products (7)

microsoft/office_for_mac

microsoft/office_for_mac

microsoft/windows_7

microsoft/windows_server_2008

microsoft/windows_server_2008

microsoft/windows_vista

n/a/n/a

Timeline

Published Dec 20, 2016

Tracked Since Feb 18, 2026