Is that CVE-2017-11884 is remote vulnerability which requires user interaction ? Can one execute it without luring the end user to run crafted file or something ? Well, I assumed that all remote vulerabilites are self standing and doesn't require user interaction, it seems that I'm wrong can you shed some light on that ?


Wether a vulnerability is remotely exploitable or not is open to interpretation sometimes.

It seems that this vulnerability allows a remote user to craft a file that when executed by the user circumvents the usual security mechanisms that should be in place for files that didn’t originate on that system.

Depending on your interpretation of “remote” there may never be remote vulnerabilities as all vulnerabilities that may be exploited on a machine are local to that machine, i.e. a problem with locally installed software.

In this case - as far as I read the vulnerability - I’d classify it as local rather than remote, but this is somewhat open to interpretation.

There are however remote vulnerabilities that need the user to interact in order to be exploited, either by clicking a button or a link or something else.

You are right that there also exist vulnerabilities that can be remotely exploited without user interaction, but they are rather rare.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.