CVE-2017-0127: microsoft corporation windows uniscribe
Vulnerability summary
CVE-2017-0127 is a medium (CVSS 4.3) vulnerability in microsoft corporation windows uniscribe. EPSS estimates a 22.47% chance of exploitation in the next 30 days, higher than 97.6% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 17-03-2017PublishedVulnerability first disclosed.
- 05-08-2024Last modifiedVulnerability information updated.
Description
Uniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Uniscribe Information Disclosure Vulnerability." CVE-2017-0085, CVE-2017-0091, CVE-2017-0092, CVE-2017-0111, CVE-2017-0112, CVE-2017-0113, CVE-2017-0114, CVE-2017-0115, CVE-2017-0116, CVE-2017-0117, CVE-2017-0118, CVE-2017-0119, CVE-2017-0120, CVE-2017-0121, CVE-2017-0122, CVE-2017-0123, CVE-2017-0124, CVE-2017-0125, CVE-2017-0126, and CVE-2017-0128.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
22.47%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
0.00 pp
From 22.47% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundMicrosoft Windows - Uniscribe Font Processing Multiple Heap Out-of-Bounds and Wild Reads (MS17-011)
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Microsoft1 product
- windows_server_2008r2:sp1
Microsoft corporation1 product
- windows uniscribeUniscribe in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1
2 vendors · 2 products
References
4 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0127X Refsource CONFIRMPatchVendor Advisory