KLA11397 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges.

Below is a complete list of vulnerabilities:

1. A memory corruption vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to execute arbitrary code.
2. A memory corruption vulnerability in Chakra Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
3. A remote code execution vulnerability in MSHTML Engine can be exploited remotely via specially crafted file to execute arbitrary code.
4. A memory corruption vulnerability in Chakra Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
5. An elevation of privilege vulnerability in Microsoft Edge can be exploited remotely via unspecified vector to gain privileges.
6. A memory corruption vulnerability in Chakra Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.

Original advisories

CVE-2019-0565

CVE-2019-0567

CVE-2019-0541

CVE-2019-0568

CVE-2019-0566

CVE-2019-0539

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Internet-Explorer

Microsoft-Edge

CVE list

CVE-2019-0541 critical

CVE-2019-0565 critical

CVE-2019-0567 critical

CVE-2019-0568 critical

CVE-2019-0566 high

CVE-2019-0539 critical

KB list

4480978

4480962

4480966

4480116

4480961

4480973

4480963

4480970

4480975

4480965

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

• Microsoft EdgeChakraCoreMicrosoft Office 2016 (64-bit edition)Internet Explorer 11Office 365 ProPlus for 32-bit SystemsMicrosoft Office Word ViewerMicrosoft Office 2019 for 32-bit editionsMicrosoft Office 2013 Service Pack 1 (32-bit editions)Microsoft Office 2019 for 64-bit editionsMicrosoft Office 2010 Service Pack 2 (64-bit editions)Internet Explorer 10Microsoft Office 2013 RT Service Pack 1Microsoft Office 2016 (32-bit edition)Office 365 ProPlus for 64-bit SystemsMicrosoft Office 2013 Service Pack 1 (64-bit editions)Microsoft Office 2010 Service Pack 2 (32-bit editions)Internet Explorer 9Microsoft Excel Viewer 2007 Service Pack 3