Lucene search

Kaspersky LabKLA12519

HistoryApr 28, 2022 - 12:00 a.m.

KLA12519 Multiple vulnerabilities in Microsoft Browser

2022-04-2800:00:00

Kaspersky Lab

threats.kaspersky.com

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

9.2 High

AI Score

Confidence

High

0.004 Low

EPSS

Percentile

72.6%

JSON

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to execute arbitrary code, cause denial of service, bypass security restrictions, gain privileges, spoof user interface.

Below is a complete list of vulnerabilities:

Use after free vulnerability in Device API can be exploited to cause denial of service or execute arbitrary code.
Data validation vulnerability in Dev Tools can be exploited to cause denial of service.
Data validation vulnerability in Trusted Types can be exploited to cause denial of service.
Implementation vulnerability in WebGL can be exploited to cause denial of service.
Use after free vulnerability in SwiftShader can be exploited to cause denial of service or execute arbitrary code.
Use after free vulnerability in Browser Switcher can be exploited to cause denial of service or execute arbitrary code.
Implementation vulnerability in HTML Parser can be exploited to cause denial of service.
Data validation vulnerability in Blink Editing can be exploited to cause denial of service.
Use after free vulnerability in Bookmarks can be exploited to cause denial of service or execute arbitrary code.
Heap buffer overflow vulnerability in Web UI Settings can be exploited to cause denial of service.
Implementation vulnerability in Extensions API can be exploited to cause denial of service.
Use after free vulnerability in File System can be exploited to cause denial of service or execute arbitrary code.
Use after free vulnerability in Dev Tools can be exploited to cause denial of service or execute arbitrary code.
Implementation vulnerability in Input can be exploited to cause denial of service.
Use after free vulnerability in Vulkan can be exploited to cause denial of service or execute arbitrary code.
Implementation vulnerability in iframe can be exploited to cause denial of service.
Use after free vulnerability in ANGLE can be exploited to cause denial of service or execute arbitrary code.
Use after free vulnerability in Sharing can be exploited to cause denial of service or execute arbitrary code.
Security UI vulnerability in Downloads can be exploited to bypass security restrictions.
Type confusion vulnerability in V8 can be exploited to cause denial of service.
Elevation of privilege vulnerability in Microsoft Edge (Chromium-based) can be exploited remotely to gain privileges.
Spoofing vulnerability in Microsoft Edge (Chromium-based) can be exploited remotely to spoof user interface.
Heap buffer overflow vulnerability in WebGPU can be exploited to cause denial of service.
Implementation vulnerability in WebAuthentication can be exploited to cause denial of service.
Use after free vulnerability in Ozone can be exploited to cause denial of service or execute arbitrary code.

Original advisories

Related products

Microsoft-Edge

CVE list

CVE-2022-1497 high

CVE-2022-1490 critical

CVE-2022-1477 critical

CVE-2022-1482 high

CVE-2022-1487 critical

CVE-2022-1488 warning

CVE-2022-1478 critical

CVE-2022-1485 critical

CVE-2022-1500 high

CVE-2022-1491 critical

CVE-2022-1492 high

CVE-2022-1495 warning

CVE-2022-1481 critical

CVE-2022-1483 critical

CVE-2022-1486 critical

CVE-2022-1494 high

CVE-2022-1484 critical

CVE-2022-1493 critical

CVE-2022-1501 high

CVE-2022-1479 critical

CVE-2022-1498 warning

CVE-2022-1480 warning

CVE-2022-1499 high

CVE-2022-29146 critical

CVE-2022-29147 warning

KB list

Solution

Install necessary updates from the Settings and more menu, that are listed in your About Microsoft Edge page (Microsoft Edge About page usually can be accessed from the Help and feedback option)

Microsoft Edge update settings

Impacts

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

Denial of service. Exploitation of vulnerabilities with this impact can lead to loss of system availability or critical functional fault.

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.