KLA11306 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, spoof user interface, obtain sensitive information, bypass security restrictions.

Below is a complete list of vulnerabilities:

1. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
2. A memory corruption vulnerability in Chakra Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
3. A memory corruption vulnerability in Scripting Engine can be exploited remotely via IMPORTANTTHING to execute arbitrary code.
4. A memory corruption vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to execute arbitrary code.
5. An elevation of privilege vulnerability in Microsoft Browser can be exploited remotely via IMPORTANTTHING to gain privileges.
6. A spoofing vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to spoof user interface.
7. A remote code execution vulnerability in Internet Explorer can be exploited remotely via specially crafted website to execute arbitrary code.
8. An information disclosure vulnerability in Microsoft Browser can be exploited remotely via IMPORTANTTHING to obtain sensitive information.
9. A memory corruption vulnerability in Microsoft Browser can be exploited remotely via specially crafted website to execute arbitrary code.
10. An information disclosure vulnerability in Microsoft Edge can be exploited remotely via IMPORTANTTHING to obtain sensitive information.
11. A security feature bypass vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to bypass security restrictions.

Original advisories

CVE-2018-8372

CVE-2018-8385

CVE-2018-8266

CVE-2018-8380

CVE-2018-8381

CVE-2018-8355

CVE-2018-8390

CVE-2018-8387

CVE-2018-8357

CVE-2018-8353

CVE-2018-8383

CVE-2018-8377

CVE-2018-8389

CVE-2018-8316

CVE-2018-8388

CVE-2018-8371

CVE-2018-8351

CVE-2018-8373

CVE-2018-8403

CVE-2018-8370

CVE-2018-8358

CVE-2018-8384

CVE-2018-8359

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Internet-Explorer

Microsoft-Edge

ChakraCore

CVE list

CVE-2018-8384 critical

CVE-2018-8372 critical

CVE-2018-8385 critical

CVE-2018-8266 critical

CVE-2018-8380 critical

CVE-2018-8359 critical

CVE-2018-8381 critical

CVE-2018-8355 critical

CVE-2018-8390 critical

CVE-2018-8387 critical

CVE-2018-8357 high

CVE-2018-8353 critical

CVE-2018-8383 warning

CVE-2018-8377 critical

CVE-2018-8389 critical

CVE-2018-8316 critical

CVE-2018-8388 warning

CVE-2018-8371 critical

CVE-2018-8351 warning

CVE-2018-8373 critical

CVE-2018-8403 critical

CVE-2018-8370 warning

CVE-2018-8358 warning

KB list

4343909

4343885

4343887

4343892

4343897

4343898

4343899

4343900

4343205

4343901

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• ChakraCoreMicrosoft Edge (EdgeHTML-based)Internet Explorer 10Internet Explorer 9Internet Explorer 11