Windows Performance Monitor Information Disclosure Vulnerability

<p>An information disclosure vulnerability exists in the Windows Performance Monitor Console when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.</p> <p>To exploit the vulnerability, an attacker could create specially crafted XML data and convince an authenticated user to create a Data Collector Set and import the file. To create a Data Collector Set, the user must be a member of the Performance Log Users or Local Administrators group.</p> <p>The update addresses the vulnerability by modifying the way that the Windows Performance Monitor Console parses XML input.</p>

Where it's fixed