CVE-2017-14088 - Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary code and escalate privileges to resources normally reserved for the kernel on vulnerable installations by exploiting tmwfp.sys

Back Back to CVE browser

HIGH

Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary code and escalate privileges to resources normally reserved for the kernel on vulnerable installations by exploiting tmwfp.sys

Published Oct 5, 2017

7.0

HIGH

CVSS 3.0

EPSS 0.67%

Description

Memory Corruption Privilege Escalation vulnerabilities in Trend Micro OfficeScan 11.0 and XG allows local attackers to execute arbitrary code and escalate privileges to resources normally reserved for the kernel on vulnerable installations by exploiting tmwfp.sys. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit the vulnerability.

Affected products

Vendor Trend Micro Product Trend Micro OfficeScan Default
n/a
- Version
  11.0, XG (12.0)
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Trend Micro

Trend Micro OfficeScan

n/a

Version	Status	Constraints
11.0, XG (12.0)	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-119

Buffer Overflow

References (5)

http://www.securityfocus.com/bid/101070
vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039500
vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-828
x_refsource_MISCThird Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-829
x_refsource_MISCThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1118372
x_refsource_CONFIRMPatchVendor Advisory

Link	Providers	Tags
http://www.securityfocus.com/bid/101070		vdb-entryx_refsource_BIDThird Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039500		vdb-entryx_refsource_SECTRACKThird Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-828		x_refsource_MISCThird Party AdvisoryVDB Entry
http://www.zerodayinitiative.com/advisories/ZDI-17-829		x_refsource_MISCThird Party AdvisoryVDB Entry
https://success.trendmicro.com/solution/1118372		x_refsource_CONFIRMPatchVendor Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner trendmicro

Published Oct 5, 2017

Updated Aug 5, 2024

Reserved Aug 31, 2017

Link CVE-2017-14088

CISA Vulnrichment

Updated n/a

NVD

Status Modified

Modified Jun 17, 2026

Link CVE-2017-14088

Red Hat

Severity n/a

Public date n/a

Links CVE-2017-14088