PT-2018-1546 · Microsoft · Office+3
Publicado
2018-09-10
·
Atualizado
2020-08-24
·
CVE-2018-8457
CVSS v2.0
7.6
Alta
| Vetor | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Edge (affected versions not specified)
Internet Explorer (affected versions not specified)
Description
The issue is related to errors in handling objects in memory by the JavaScript script handler ChakraCore in Microsoft browsers. Exploitation of this issue could allow a remote attacker to execute arbitrary code using a specially crafted web page, application, or Microsoft Office document. This could corrupt memory, enabling the attacker to gain the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Edge, update to a version that includes the fix for this issue.
For Internet Explorer, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to potentially vulnerable web pages or documents until a patch is available.
Avoid using applications or features that rely on the vulnerable scripting engine until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Memory Corruption
Buffer Overflow
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Chakracore
Edge
Internet Explorer
Office