Remote Code Execution Vulnerability in Microsoft Browsers
CVE-2017-0238

7.5HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Browsers
Vendor
CVE Published:
12 May 2017

Summary

A vulnerability exists in Microsoft browsers due to the improper handling of objects in memory by JavaScript scripting engines. This flaw can allow an attacker to execute arbitrary code on the affected system if a user visits a specially crafted web page. Successful exploitation may lead to full system compromise, allowing the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.

Affected Version(s)

Microsoft browsers Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows RT 8.1, Windows Server 2012, Windows Server 2012 R2, Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems, Windows 10 Version 1511 for 32-bit Systems, Windows 10 Version 1511 for x64-based Systems, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1703 for 32-bit Systems, and Windows 10 Version 1703 for x64-based Systems, and Windows Server 2016.

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_CONFIRM
http://www.securityfocus.com/bid/98237
vdb-entryx_refsource_BID

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.