CVE-2018-1037

MediumCVSS 4.3/10Last modified Jun 17, 2026

Description

An information disclosure vulnerability exists when Visual Studio improperly discloses limited contents of uninitialized memory while compiling program database (PDB) files, aka "Microsoft Visual Studio Information Disclosure Vulnerability." This affects Microsoft Visual Studio.

Metrics

CVSS 3.0 4.3/10CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-908

Affected software

Vendor	Product	Versions
Microsoft	Microsoft Visual Studio	2010 Service Pack 1; 2012 Update 5; 2013 Update 5; 2015 Update 3; 2017; 2017 Version 15.6.6; 2017 Version 15.7 Preview

References

http://www.securityfocus.com/bid/103715Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040664Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1037Patch, Vendor Advisory
http://www.securityfocus.com/bid/103715Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040664Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-1037Patch, Vendor Advisory

Timeline

Published: Apr 12, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-103716.1An issue was discovered in the wunderfarm WF Cookie Consent plugin 1.1.3 for WordPress. A persistent cross-site scripting vulnerability has CVE-2018-103725.5process_cu_tu_index in dwarf.c in GNU Binutils 2.30 allows remote attackers to cause a denial of service (heap-based buffer over-read and ap CVE-2018-103736.5concat_filename in dwarf2.c in the Binary File Descriptor (BFD) library (aka libbfd), as distributed in GNU Binutils 2.30, allows remote att CVE-2018-103746.1EasyCMS 1.3 has XSS via the s POST parameter (aka a search box value) in an index.php?s=/index/search/index.html request.CVE-2018-103759.8A file uploading vulnerability exists in /include/helpers/upload.helper.php in DedeCMS V5.7 SP2, which can be utilized by attackers to uploa CVE-2018-103767.5An integer overflow in the transferProxy function of a smart contract implementation for SmartMesh (aka SMT), an Ethereum ERC20 token, allow CVE-2018-103775.9PortSwigger Burp Suite before 1.7.34 has Improper Certificate Validation of the Collaborator server certificate, which might allow man-in-th CVE-2018-103796.1An issue was discovered in GitLab Community Edition (CE) and Enterprise Edition (EE) before 10.5.8, 10.6.x before 10.6.5, and 10.7.x before CVE-2018-10387.8The Windows kernel in Windows 7 SP1 and Windows Server 2008 R2 SP1 allows an elevation of privilege vulnerability due to the way it handles CVE-2018-103807.8kwallet-pam in KDE KWallet before 5.12.6 allows local users to obtain ownership of arbitrary files via a symlink attack.CVE-2018-103819.8TunnelBear 3.2.0.6 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "TunnelBearMaintenance" service. This se CVE-2018-103825.4MODX Revolution 2.6.3 has XSS.