KLA12019 Multiple vulnerabilities in Microsoft Browsers

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code.

Below is a complete list of vulnerabilities:

1. A spoofing vulnerability in Microsoft Edge for Android can be exploited remotely to spoof user interface.
2. A memory corruption vulnerability in Chakra Scripting Engine can be exploited remotely to execute arbitrary code.

Original advisories

CVE-2020-17153

CVE-2020-17131

Related products

Microsoft-Edge

ChakraCore

CVE list

CVE-2020-17153 warning

CVE-2020-17131 warning

KB list

4592449

4592440

4592438

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• ChakraCoreMicrosoft Edge (EdgeHTML-based)Microsoft Edge for Android