Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."
The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.
| Link | Tags |
|---|---|
| http://www.securityfocus.com/bid/96069 | broken link third party advisory vdb entry |
| https://0patch.blogspot.com/2017/09/exploit-kit-rendezvous-and-cve-2017-0022.html | exploit |
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0022 | patch vendor advisory |
| http://www.securitytracker.com/id/1038014 | broken link third party advisory vdb entry |