CVE-2017-11768 Information disclosure in Windows Media Player

What is CVE-2017-11768?

CVE-2017-11768 is a low-severity vulnerability in Microsoft Windows Media Player, published on 15 Nov 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows remote attackers to test for the presence of files on disk via a specially crafted application. due to the way Windows Media Player discloses file information, aka "Windows Media Player Information Disclosure Vulnerability."

Weakness: CWE-200

Which versions are affected by CVE-2017-11768?

It affects 1 product.

Products include Microsoft Windows Media Player.

How do I fix CVE-2017-11768?

No fix has been published for CVE-2017-11768 yet. Limit exposure of the affected software until one is available.

Is CVE-2017-11768 being exploited?

There is no known exploitation of CVE-2017-11768 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Windows Media Player

• CVE-2008-3010 Information disclosure in n/a Critical 10.0
• CVE-2015-1728 Code injection in n/a Critical 9.3
• CVE-2010-2745 Memory corruption in n/a Critical 9.3
• CVE-2009-2527 Memory corruption in n/a Critical 9.3
• CVE-2009-1331 Integer overflow in n/a Critical 9.3

All Microsoft Windows Media Player vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9hg9-45xx-r2q2.