IP-DB.com
Türkçe English Deutsch Español
Giriş API Anahtarı Al
8.8Yüksek KEV

CVE-2017-8464Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

Microsoft Corporation Windows Shell Yayım: (9 yıl önce)

Aktif olarak istismar ediliyor — Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability

CISA bu açığın gerçek saldırılarda kullanıldığını 10.02.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 10.08.2022.

Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2017-8464

Açıklama

Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows local users or remote attackers to execute arbitrary code via a crafted .LNK file, which is not properly handled during icon display in Windows Explorer or any other application that parses the icon of the shortcut. aka "LNK Remote Code Execution Vulnerability."

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

ÜreticiÜrünSürümler
microsoft windows 10 1511 —
microsoft windows 10 1607 —
microsoft windows 10 1703 —
microsoft windows 7 —
microsoft windows 8.1 —
microsoft windows rt 8.1 —
microsoft windows server 2008 r2
microsoft windows server 2012 r2
microsoft windows server 2016 —
Microsoft Corporation Windows Shell Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016

Kaynaklar ve yamalar

CPE eşleşmeleri (NVD) (12)
  • cpe:2.3:o:microsoft:windows_10_1511:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_10_1703:*:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

Aynı üründe son açıklar — Windows 10

7.0Yüksek
CVE-2026-108135

Windows Backup Engine Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2; Microsoft Windows 11 version 23H2; Microsoft Windows 11 Version 23H2

Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to elevate privileges locally.

6.5Orta
CVE-2026-108129

Role: DNS Server Information Disclosure Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.

1.1%EPSS