PT-2017-18449 · Microsoft · Windows 10+1

Ivan Fratric · Publicado 2017-08-08 · Atualizado 2019-10-03 · CVE-2017-8637

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Baixa

Vetor base

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge in Microsoft Windows 10 1703

Description A security feature bypass issue exists due to how Microsoft Edge accesses memory in code compiled by the Edge Just-In-Time (JIT) compiler, allowing Arbitrary Code Guard (ACG) to be bypassed. This issue does not allow arbitrary code execution on its own but could be used in conjunction with another vulnerability, such as a remote code execution vulnerability, to run arbitrary code on a target system. Exploitation requires a user to be logged on and running an affected version of Microsoft Edge, and then browse to a malicious website.

Recommendations For Microsoft Edge in Microsoft Windows 10 1703, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Identificadores relacionados

CVE-2017-8637

Produtos afetados

Edge

Windows 10

Referências · 5

• http://securitytracker.com/id/1039095 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8637 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8637 · Nota de Segurança
• http://securityfocus.com/bid/100045 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8637 · Aviso do Fabricante