Type confusion in Microsoft Edge and Microsoft Internet Explorer - CVE-2017-0037

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to type confusion error within HandleColumnBreakOnColumnSpanningElement when processing CSS elements. A remote attacker can create a specially crafted web page, trick the victim into opening it and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may allow an attacker to compromise vulnerable system.

Note: Exploit code for this vulnerability is publicly accessible.

Affected software

How to mitigate CVE-2017-0037

Links to Public Exploits and PoC-codes

• Exploit #1055 - Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007) (March 18, 2020)
• Exploit #1056 - Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007) (March 18, 2020)
• Exploit #1057 - Microsoft Edge and Internet Explorer - 'HandleColumnBreakOnColumnSpanningElement' Type Confusion (March 18, 2020)

External References

• https://bugs.chromium.org/p/project-zero/issues/detail?id=1011
• https://www.symantec.com/security_response/writeup.jsp?docid=2017-030123-2706-99&tabid=2
• https://technet.microsoft.com/en-us/library/security/MS17-006
• https://technet.microsoft.com/en-us/library/security/MS17-007

Related Security Bulletins

• Remote code execution in Microsoft Internet Explorer and Edge
• Microsoft Browser Memory Corruption Vulnerability