Published: 13/10/2017 Updated: 03/10/2019

CVSS v2 Base Score: 7.6 | Impact Score: 10 | Exploitability Score: 4.9

CVSS v3 Base Score: 7.5 | Impact Score: 5.9 | Exploitability Score: 1.6

VMScore: 676

Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C

Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an malicious user to execute arbitrary code in the context of the current user, due to how Microsoft Windows Text Services Framework handles objects in memory, aka "Windows Shell Memory Corruption Vulnerability".

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft windows server 2016
microsoft windows 10 1607
microsoft windows 10 1703
microsoft windows rt 8.1
microsoft windows server 2008
microsoft windows 7
microsoft windows server 2012 -
microsoft windows server 2012 r2
microsoft windows 10 1511
microsoft windows 8.1
microsoft windows server 2008 r2
microsoft windows 10 -

It's 2017... And Windows PCs can be pwned via DNS, webpages, Office docs, fonts – and some TPM keys are fscked too

The Register • Shaun Nichols in San Francisco • 10 Oct 2017

But at least there's no Flash update (not this week, anyway)

Microsoft today released patches for more than 60 CVE-listed vulnerabilities in its software. Meanwhile, Adobe is skipping October's Patch Tuesday altogether. Among the latest holes that need papering over via Windows Update are three vulnerabilities already publicly disclosed – with one being exploited right now by hackers to infect vulnerable machines. That flaw, CVE-2017-11826, is leveraged when a booby-trapped Microsoft Office document is opened, allowing malicious code within it to run wi...

CVE-2017-8727

Vulnerability Summary

Recent Articles

References

Vulmon Search

About

Products

Connect