Patch Tuesday, April 2017
Microsoft's monthly security release, Tuesday, April 11, 2017. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
2 CVEs · 0 critical · 2 exploited · 1 with public exploit code
- 7.8HighApr 12, 2017Microsoft Office and WordPad Code / command injectionCVE-2017-0199Microsoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.Exploited99% likelyExploit codeExploit-DB · MetasploitDetection
- 8.8HighApr 12, 2017Microsoft Internet Explorer Privilege escalationCVE-2017-0210A privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.Exploited22% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
No tracked SAP CVEs in this window.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.