Kaspersky LabKLA11158KLA11158 Multiple vunlerabilities in Microsoft Browsers
7.6 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.947 High
EPSS
Percentile
99.3%
Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information.
Below is a complete list of vulnerabilities:
- A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
- An information disclosure vulnerability in Internet Explorer can be exploited remotely via specially crafted content to obtain sensitive information.
- A memory corruption vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to execute arbitrary code.
- An information disclosure vulnerability in Scripting Engine can be exploited remotely via specially crafted content to obtain sensitive information.
- A memory corruption vulnerability in Scripting Engine can be exploited remotely via IMPORTANTTHING to execute arbitrary code.
Original advisories
Exploitation
Public exploits exist for this vulnerability.
Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
Related products
CVE list
CVE-2017-11886 critical
CVE-2017-11887 warning
CVE-2017-11888 critical
CVE-2017-11889 critical
CVE-2017-11890 critical
CVE-2017-11893 critical
CVE-2017-11894 critical
CVE-2017-11895 critical
CVE-2017-11901 critical
CVE-2017-11903 critical
CVE-2017-11905 critical
CVE-2017-11906 warning
CVE-2017-11907 critical
CVE-2017-11908 critical
CVE-2017-11909 critical
CVE-2017-11910 critical
CVE-2017-11911 critical
CVE-2017-11912 critical
CVE-2017-11913 critical
CVE-2017-11914 critical
CVE-2017-11918 critical
CVE-2017-11919 warning
CVE-2017-11930 critical
CVE-2017-11916 critical
KB list
Solution
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Impacts
- ACE
Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.
- OSI
Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.
Affected Products
- ChakraCoreMicrosoft Edge (EdgeHTML-based)Internet Explorer 9Internet Explorer 10Internet Explorer 11
References
support.microsoft.com/kb/4052978
support.microsoft.com/kb/4053578
support.microsoft.com/kb/4053579
support.microsoft.com/kb/4053580
support.microsoft.com/kb/4053581
support.microsoft.com/kb/4054517
support.microsoft.com/kb/4054518
support.microsoft.com/kb/4054519
support.microsoft.com/kb/4054520
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11886
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11887
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11888
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11889
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11890
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11893
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11894
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11895
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11901
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11903
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11905
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11906
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11907
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11908
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11909
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11910
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11911
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11912
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11913
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11914
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11916
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11918
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11919
portal.msrc.microsoft.com/api/security-guidance/en-US/CVE/CVE-2017-11930
statistics.securelist.com/
threats.kaspersky.com/en/class/Exploit/
threats.kaspersky.com/en/product/ChakraCore/
threats.kaspersky.com/en/product/Microsoft-Edge/
threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/
Related
7.6 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
8 High
AI Score
Confidence
High
0.947 High
EPSS
Percentile
99.3%