Main Vulnerability Database Vulnerabilities #VU9275

Memory corruption in Microsoft Edge - CVE-2017-11873

Published: November 14, 2017 / Updated: September 14, 2018

Vulnerability identifier: #VU9275

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11873

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to improper handling of objects in memory in Microsoft Edge by the scripting engine. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability may result in remote code execution.

Affected software

Microsoft Edge
ChakraCore

How to mitigate CVE-2017-11873

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #1370 - Microsoft Edge Chakra: JIT - 'OP_Memset' Type Confusion (March 18, 2020)

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11873