4 ms·

Exploitation likeliness after patch doesn't really make sense. maybe you're reading it wrong? See the page for yourself. Exploitation unlikely at the time of e

by zeusk 5y ago

Exploitation likeliness after patch doesn't really make sense. maybe you're reading it wrong? See the page for yourself. Exploitation unlikely at the time of exploit discovery. A patch has been released. This means, the reason why it shows up on the list is because people are running unpatched software. And it's really alarming because the 2017 CVE is for Office 2007 that's ~15 years old (with a patch available!).

lucb1e 5y ago
Then I'm not sure what you meant to say about the patch being available and thus the problem just being not updating. The "exploitation not likely" statement is simply wrong if it's in the top list of this agency right? Replying to your edit: > that's ~15 years old (with a patch available!) I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. The age of the product isn't the same as how fast they install security updates (but yeah apparently 2-3 years depending on the exact timeline (the stats are from 2020), so that's practically never).
- zeusk 5y ago
  >> I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. Sure, but it's a CVE for a 15 year old software. At this point, running 15 year old software unpatched on machines connected to internet is just negligence on user's part. Maybe we do need forced updates as default.
  - genewitch 5y ago
    Patches annoy end users. A lot. Anecdote: latest set of windows patches did something to Bluetooth, such that when I switch my mouse between machines there's up to a 3 second lag before the cursor is responsive. Big deal, minor nuisance, right? Except if I'm in a Fullscreen application, it causes a blue screen because the os waiting for the mouse to handshake pauses the GPU for some reason, and the GPU-Windows framework panics and blue screens to prevent hardware damage. This has the side effect of corrupting the application that was running during the blue screen, sometimes forcing a reinstall. I have no idea what patch it was that caused this, nor can I really expect anyone to fix it, how often are most(98%?) users connecting and disconnecting their mouse every day? I'm switching it dozens of times an hour.
    - zeusk 5y ago
      Do you have a picture of the bluescreen or was the crash recently? Since Vista GPU hangs or TDRs don't cause blue screen. It's likely something else that's causing your system to hangup on bluetooth connections. Your best bet is to file a feedback hub bug, if enough people are facing it - our tools will flag either the update or the device drivers identified as common in crash dumps. If you're keen, I could take a look at your crash dump file. My email is firstname.lastname@microsoft.com (you'll find me at github.com/zeusk)

by zeusk 5y ago

lucb1e 5y ago

Then I'm not sure what you meant to say about the patch being available and thus the problem just being not updating. The "exploitation not likely" statement is simply wrong if it's in the top list of this agency right? Replying to your edit: > that's ~15 years old (with a patch available!) I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. The age of the product isn't the same as how fast they install security updates (but yeah apparently 2-3 years depending on the exact timeline (the stats are from 2020), so that's practically never).

zeusk 5y ago
>> I haven't looked into this one, but you mention it's a 2017 CVE. That means the vuln was discovered (not even necessarily patched and disclosed) in 2017 and not 15 years ago. Sure, but it's a CVE for a 15 year old software. At this point, running 15 year old software unpatched on machines connected to internet is just negligence on user's part. Maybe we do need forced updates as default.
- genewitch 5y ago
  Patches annoy end users. A lot. Anecdote: latest set of windows patches did something to Bluetooth, such that when I switch my mouse between machines there's up to a 3 second lag before the cursor is responsive. Big deal, minor nuisance, right? Except if I'm in a Fullscreen application, it causes a blue screen because the os waiting for the mouse to handshake pauses the GPU for some reason, and the GPU-Windows framework panics and blue screens to prevent hardware damage. This has the side effect of corrupting the application that was running during the blue screen, sometimes forcing a reinstall. I have no idea what patch it was that caused this, nor can I really expect anyone to fix it, how often are most(98%?) users connecting and disconnecting their mouse every day? I'm switching it dozens of times an hour.
  - zeusk 5y ago
    Do you have a picture of the bluescreen or was the crash recently? Since Vista GPU hangs or TDRs don't cause blue screen. It's likely something else that's causing your system to hangup on bluetooth connections. Your best bet is to file a feedback hub bug, if enough people are facing it - our tools will flag either the update or the device drivers identified as common in crash dumps. If you're keen, I could take a look at your crash dump file. My email is firstname.lastname@microsoft.com (you'll find me at github.com/zeusk)