KLA11605 Multiple vulnerabilities in Microsoft Browser

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A security feature bypass vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to bypass security restrictions.
2. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
3. A remote code execution vulnerability in VBScript can be exploited remotely via specially crafted website to execute arbitrary code.

Original advisories

CVE-2019-1413

CVE-2019-1426

CVE-2019-1429

CVE-2019-1428

CVE-2019-1390

CVE-2019-1427

Exploitation

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Internet-Explorer

Microsoft-Edge

ChakraCore

CVE list

CVE-2019-1413 warning

CVE-2019-1426 critical

CVE-2019-1429 critical

CVE-2019-1428 critical

CVE-2019-1390 critical

CVE-2019-1427 critical

KB list

4525246

4525243

4524570

4525235

4525237

4525232

4525106

4525236

4523205

4525241

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Affected Products

• Internet Explorer 9Internet Explorer 10ChakraCoreMicrosoft Edge (EdgeHTML-based)Internet Explorer 11