KLA10988 Information disclosure vulnerability in Windows DirectShow

An improper objects handling in memory was found in Windows DirectShow. By exploiting this vulnerability malicious users can obtain sensitive information. This vulnerability can be exploited remotely via a specially designed website.

Original advisories

MS17-021

CVE-2017-0042

Related products

Microsoft-Windows-Vista-4

Microsoft-Windows-Server-2012

Microsoft-Windows-7

Microsoft-Windows-Server-2008

Windows-RT

Microsoft-Windows-10

CVE list

CVE-2017-0042 warning

KB list

4015551

4012215

4012216

4012606

4013198

4013429

4012212

4012213

4010318

3214051

4015548

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft Windows Vista Service Pack 2Microsoft Windows 7 Service Pack 1Microsoft Windows 8.1Microsoft Windows RT 8.1Microsoft Windows 10Microsoft Windows Server 2008 Service Pack 2Microsoft Windows Server 2008 R2 Service Pack 1Microsoft Windows Server 2012Microsoft Windows Server 2012 R2