96652vdb entry
http://www.securityfocus.com/bid/96652 CVE-2017-0085
MEDIUM
Microsoft Windows - Uniscribe Font Processing Out-of-Bounds Read in usp10!otlChainRuleSetTable::rule (MS17-011)
Record summary
CVE-2017-0085 has a selected CVSS score of 4.3 (medium); EIP currently links 1 catalogued exploit.
Description
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Uniscribe Information Disclosure Vulnerability." CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, CVE-2017-0127, and CVE-2017-0128.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Windows UniscribeBrowse Microsoft Corporation / Windows Uniscribe | CVE List | Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBMicrosoft Windows - Uniscribe Font Processing Out-of-Bounds Read in usp10!otlChainRuleSetTable::rule (MS17-011)ExploitDB exploitby Google Security ResearchNot analyzed1 file
References
51037992vdb entry
http://www.securitytracker.com/id/1037992 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2017-0085 portal.msrc.microsoft.comConfirmation
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0085 41646exploit
https://www.exploit-db.com/exploits/41646