Vulnerability Name:

CVE-2018-1037

Assigned:2017-12-01
Published:2018-04-10
Updated:2018-05-17
Summary:An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program database (PDB) files, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.
CVSS v3 Severity:4.3 Medium (CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
3.8 Low (Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
2.9 Low (CCN CVSS v3 Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)
2.6 Low (CCN Temporal CVSS v3 Vector: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
1.2 Low (CCN CVSS v2 Vector: AV:L/AC:H/Au:N/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): High
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
Vulnerability Type:CWE-200
References:Source: BID
Type: VENDOR_ADVISORY
103715

Source: SECTRACK
Type: VENDOR_ADVISORY
1040664

Source: XF
Type: UNKNOWN
ms-visual-cve20181037-info-disc(141341)

Source: CONFIRM
Type: VENDOR_ADVISORY
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1037

Vulnerable Configuration:Configuration 1:
  • cpe:/a:microsoft:visual_studio:2010:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2012:update5:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2013:update5:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2015:update3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2017:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2017:15.6.6:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2017:15.7:preview:*:*:*:*:*

  • Configuration CCN 1:
  • cpe:/a:microsoft:visual_studio:2010:sp1:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2015:update3:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2013:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:visual_studio:2012:*:*:*:*:*:*:*

  • Denotes that component is vulnerable
    BACK
    microsoft visual studio 2010 sp1
    microsoft visual studio 2012 update5
    microsoft visual studio 2013 update5
    microsoft visual studio 2015 update3
    microsoft visual studio 2017
    microsoft visual studio 2017 15.6.6
    microsoft visual studio 2017 15.7
    microsoft visual studio 2010 sp1
    microsoft visual studio 2015 update3
    microsoft visual studio 2013
    microsoft visual studio 2012