CVE-2018-8332
Summary
| CVE | CVE-2018-8332 |
|---|---|
| State | PUBLIC |
| Assigner | [email protected] |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2018-09-13 00:29:00 UTC |
| Updated | 2019-10-03 00:03:00 UTC |
| Description | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts, aka "Win32k Graphics Remote Code Execution Vulnerability." This affects Windows 7, Microsoft Office, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2008 R2, Windows Server 2012, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers. |
Risk And Classification
Problem Types: NVD-CWE-noinfo
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Microsoft | Office | 2016 | All | All | All |
| Application | Microsoft | Office | 2016 | All | All | All |
| Application | Microsoft | Office For Mac | 2016 | All | All | All |
| Application | Microsoft | Office For Mac | 2016 | All | All | All |
| Operating System | Microsoft | Windows 10 | - | All | All | All |
| Operating System | Microsoft | Windows 10 | 1607 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1703 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1709 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1803 | All | All | All |
| Operating System | Microsoft | Windows 10 | - | All | All | All |
| Operating System | Microsoft | Windows 10 | 1607 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1703 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1709 | All | All | All |
| Operating System | Microsoft | Windows 10 | 1803 | All | All | All |
| Operating System | Microsoft | Windows 7 | - | sp1 | All | All |
| Operating System | Microsoft | Windows 7 | - | sp1 | All | All |
| Operating System | Microsoft | Windows 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows 8.1 | - | All | All | All |
| Operating System | Microsoft | Windows Server | 2008 | r2 | sp1 | All |
| Operating System | Microsoft | Windows Server | 2008 | r2 | sp1 | All |
| Operating System | Microsoft | Windows Server | 2008 | sp2 | All | All |
| Operating System | Microsoft | Windows Server | 2012 | All | All | All |
| Operating System | Microsoft | Windows Server | 2012 | r2 | All | All |
| Operating System | Microsoft | Windows Server | 2016 | All | All | All |
| Operating System | Microsoft | Windows Server | 2016 | 1709 | All | All |
| Operating System | Microsoft | Windows Server | 2016 | 1803 | All | All |
| Operating System | Microsoft | Windows Server | 2008 | r2 | sp1 | All |
| Operating System | Microsoft | Windows Server | 2008 | r2 | sp1 | All |
| Operating System | Microsoft | Windows Server | 2008 | sp2 | All | All |
| Operating System | Microsoft | Windows Server | 2012 | All | All | All |
| Operating System | Microsoft | Windows Server | 2012 | r2 | All | All |
| Operating System | Microsoft | Windows Server | 2016 | All | All | All |
| Operating System | Microsoft | Windows Server | 2016 | 1709 | All | All |
| Operating System | Microsoft | Windows Server | 2016 | 1803 | All | All |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| Windows Font Library Embedded Font File Processing Flaw Lets Remote Users Execute Arbitrary Code - SecurityTracker | SECTRACK | www.securitytracker.com | Third Party Advisory, VDB Entry |
| Microsoft Windows 'Win32k.sys' Graphics CVE-2018-8332 Remote Code Execution Vulnerability | BID | www.securityfocus.com | Third Party Advisory, VDB Entry |
| portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8332 | CONFIRM | portal.msrc.microsoft.com | Patch, Vendor Advisory |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.