Think you have a false positive on this rule?

Sid 1-41946

Message

FILE-IMAGE Microsoft GDI+ malformed EMF description out of bounds read attempt

Summary

The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI+ Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0073.

Impact

CVSS base score 4.7 CVSS impact score 3.6 CVSS exploitability score 1.0 confidentialityImpact HIGH integrityImpact NONE availabilityImpact NONE

CVE-2017-0062:

CVSS base score 4.7

CVSS impact score 3.6

CVSS exploitability score 1.0

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

CVE-2018-12849:

CVSS base score 7.5

CVSS impact score 3.6

CVSS exploitability score 3.9

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Detailed information

CVE-2017-0062: The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "GDI+ Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0060 and CVE-2017-0073.

CVE-2018-12849: Adobe Acrobat and Reader versions 2018.011.20058 and earlier, 2017.011.30099 and earlier, and 2015.006.30448 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.

Affected systems

  • microsoft windows_10 -
  • microsoft windows_10 1511
  • microsoft windows_10 1607
  • microsoft windows_7 *
  • microsoft windows_8.1 *
  • microsoft windowsrt8.1 *
  • microsoft windowsserver2008 *
  • microsoft windowsserver2008 r2
  • microsoft windowsserver2012 -
  • microsoft windowsserver2012 r2
  • microsoft windows_vista *
  • adobe acrobat 17.011.30059
  • adobe acrobat 17.011.30065
  • adobe acrobat 17.011.30068
  • adobe acrobat 17.011.30070
  • adobe acrobat 17.011.30096
  • adobe acrobat_dc 15.006.30060
  • adobe acrobat_dc 15.006.30094
  • adobe acrobat_dc 15.006.30096
  • adobe acrobat_dc 15.006.30097
  • adobe acrobat_dc 15.006.30119
  • adobe acrobat_dc 15.006.30121
  • adobe acrobat_dc 15.006.30172
  • adobe acrobat_dc 15.006.30173
  • adobe acrobat_dc 15.006.30174
  • adobe acrobat_dc 15.006.30198
  • adobe acrobat_dc 15.006.30201
  • adobe acrobat_dc 15.006.30243
  • adobe acrobat_dc 15.006.30244
  • adobe acrobat_dc 15.006.30279
  • adobe acrobat_dc 15.006.30280
  • adobe acrobat_dc 15.006.30306
  • adobe acrobat_dc 15.006.30352
  • adobe acrobat_dc 15.006.30354
  • adobe acrobat_dc 15.006.30355
  • adobe acrobat_dc 15.006.30392
  • adobe acrobat_dc 15.006.30394
  • adobe acrobat_dc 15.006.30434
  • adobe acrobat_dc 15.008.20082
  • adobe acrobat_dc 15.009.20069
  • adobe acrobat_dc 15.009.20071
  • adobe acrobat_dc 15.009.20077
  • adobe acrobat_dc 15.009.20079
  • adobe acrobat_dc 15.010.20056
  • adobe acrobat_dc 15.010.20059
  • adobe acrobat_dc 15.010.20060
  • adobe acrobat_dc 15.016.20039
  • adobe acrobat_dc 15.016.20041
  • adobe acrobat_dc 15.016.20045
  • adobe acrobat_dc 15.017.20050
  • adobe acrobat_dc 15.017.20053
  • adobe acrobat_dc 15.020.20039
  • adobe acrobat_dc 15.020.20042
  • adobe acrobat_dc 15.023.20053
  • adobe acrobat_dc 15.023.20056
  • adobe acrobat_dc 15.023.20070
  • adobe acrobat_dc 17.009.20044
  • adobe acrobat_dc 17.009.20058
  • adobe acrobat_dc 17.012.20093
  • adobe acrobat_dc 17.012.20095
  • adobe acrobat_dc 17.012.20096
  • adobe acrobat_dc 17.012.20098
  • adobe acrobat_dc 18.009.20044
  • adobe acrobat_dc 18.009.20050
  • adobe acrobat_dc 18.011.20055
  • adobe acrobat_reader 17.011.30059
  • adobe acrobat_reader 17.011.30096
  • adobe acrobatreaderdc 15.006.30060
  • adobe acrobatreaderdc 15.006.30094
  • adobe acrobatreaderdc 15.006.30096
  • adobe acrobatreaderdc 15.006.30097
  • adobe acrobatreaderdc 15.006.30119
  • adobe acrobatreaderdc 15.006.30121
  • adobe acrobatreaderdc 15.006.30172
  • adobe acrobatreaderdc 15.006.30173
  • adobe acrobatreaderdc 15.006.30174
  • adobe acrobatreaderdc 15.006.30198
  • adobe acrobatreaderdc 15.006.30201
  • adobe acrobatreaderdc 15.006.30243
  • adobe acrobatreaderdc 15.006.30244
  • adobe acrobatreaderdc 15.006.30279
  • adobe acrobatreaderdc 15.006.30280
  • adobe acrobatreaderdc 15.006.30306
  • adobe acrobatreaderdc 15.006.30352
  • adobe acrobatreaderdc 15.006.30354
  • adobe acrobatreaderdc 15.006.30355
  • adobe acrobatreaderdc 15.006.30392
  • adobe acrobatreaderdc 15.006.30394
  • adobe acrobatreaderdc 15.006.30434
  • adobe acrobatreaderdc 15.008.20082
  • adobe acrobatreaderdc 15.009.20069
  • adobe acrobatreaderdc 15.009.20071
  • adobe acrobatreaderdc 15.009.20077
  • adobe acrobatreaderdc 15.009.20079
  • adobe acrobatreaderdc 15.010.20056
  • adobe acrobatreaderdc 15.010.20059
  • adobe acrobatreaderdc 15.010.20060
  • adobe acrobatreaderdc 15.016.20039
  • adobe acrobatreaderdc 15.016.20041
  • adobe acrobatreaderdc 15.016.20045
  • adobe acrobatreaderdc 15.017.20050
  • adobe acrobatreaderdc 15.017.20053
  • adobe acrobatreaderdc 15.020.20039
  • adobe acrobatreaderdc 15.020.20042
  • adobe acrobatreaderdc 15.023.20053
  • adobe acrobatreaderdc 15.023.20056
  • adobe acrobatreaderdc 15.023.20070
  • adobe acrobatreaderdc 17.009.20044
  • adobe acrobatreaderdc 17.009.20058
  • adobe acrobatreaderdc 17.012.20093
  • adobe acrobatreaderdc 17.012.20095
  • adobe acrobatreaderdc 17.012.20098
  • adobe acrobatreaderdc 18.009.20044
  • adobe acrobatreaderdc 18.009.20050
  • adobe acrobatreaderdc 18.011.20055

Ease of attack

CVE-2017-0062:

Access Vector

Access Complexity

Authentication

CVE-2018-12849:

Access Vector

Access Complexity

Authentication

False positives

None known

False negatives

None known

Corrective action

Contributors

  • Talos research team.
  • This document was generated from data supplied by the national vulnerability database, a product of the national institute of standards and technology.
  • For more information see nvd.

Additional References

  • helpx.adobe.com/security/products/acrobat/APSB18-34.html
  • technet.microsoft.com/en-us/security/bulletin/MS17-013