Lucene search

[email protected]CVE-2017-0037

HistoryFeb 26, 2017 - 11:59 p.m.

CVE-2017-0037

2017-02-2623:59:00

CWE-704

[email protected]

web.nvd.nist.gov

867

In Wild

cve-2017-0037

microsoft

internet explorer

edge

type confusion

mshtml.dll

remote code execution

css

javascript

nvd

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

8.1 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

6.4 Medium

AI Score

Confidence

High

0.973 High

EPSS

Percentile

99.9%

JSON

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

Affected configurations

Vulners

NVD

Node

microsoft_corporationinternet_browser

CPENameOperatorVersion
microsoft:edgemicrosoft edgeeq*
microsoft:internet_explorermicrosoft internet explorereq11

CPE	Name	Operator	Version
microsoft:edge	microsoft edge	eq	*
microsoft:internet_explorer	microsoft internet explorer	eq	11

CNA Affected

[
  {
    "product": "Internet Browser",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Internet Explorer 10 and 11 and Edge"
      }
    ]
  }
]