CVE-2017-0283

EPSS 39.0%

Vexday Risk Score

35Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS —EPSS 39.0%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

15 Jun 2017Published on NVD

23 Jun 2017Public PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Uniscribe in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, Windows Server 2016, Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office Word Viewer, Microsoft Lync 2013 SP1, Skype for Business 2016, Microsoft Silverlight 5 Developer Runtime when installed on Microsoft Windows, and Microsoft Silverlight 5 when installed on Microsoft Windows allows a remote code execution vulnerability due to the way it handles objects in memory, aka "Windows Uniscribe Remote Code Execution Vulnerability". This CVE ID is unique from CVE-2017-8528.

Affected products

Microsoft Corporation · Uniscribe

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/42234/unverified exploitdbwww.exploit-db.com/exploits/42234unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://0patch.blogspot.com/2017/07/0patching-quick-brown-fox-of-cve-2017.html https://bugs.chromium.org/p/project-zero/issues/detail?id=1198 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0283 https://www.exploit-db.com/exploits/42234/http://www.securityfocus.com/bid/98920 http://www.securitytracker.com/id/1038675