Vulnerability Name:

CVE-2018-1037

Assigned:2017-12-01
Published:2018-04-10
Updated:2018-04-12
Summary:An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program database (PDB) files, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
CVSS v3 Severity:2.9 Low (CCN CVSS v3 Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
2.6 Low (CCN Temporal CVSS v3 Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:1.2 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
References:Source: BID
Type: UNKNOWN
103715

Source: SECTRACK
Type: UNKNOWN
1040664

Source: XF
Type: UNKNOWN
ms-visual-cve20181037-info-disc(141341)

Source: CONFIRM
Type: UNKNOWN
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1037

Vulnerable Configuration:
Configuration CCN 1:
  • cpe:/a:microsoft:visual_studio:2010:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2013:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2012:*:*:*:*:*:*:*

  • Denotes that component is vulnerable
    BACK
    microsoft visual studio 2010 sp1
    microsoft visual studio 2013
    microsoft visual studio 2012