PT-2017-12247 · Microsoft · Windows Server 2016+9
Hui Gao
·
Published
2017-11-14
·
Updated
2017-12-07
·
CVE-2017-11791
CVSS v3.1
3.1
Low
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft Edge and Internet Explorer versions in Windows 10 Gold, 1511, 1607, 1703, 1709
ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows Server 2016 and Windows Server, version 1709
Description
An information disclosure issue exists due to the improper handling of objects in memory by the scripting engine in Microsoft browsers. This could allow an attacker to obtain information that could be used to further compromise the user's system.
Recommendations
For Windows 10 Gold, 1511, 1607, 1703, 1709, update to a version that includes the fix for this issue.
For Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows Server 2016 and Windows Server, version 1709, apply the necessary security updates to resolve the issue.
As a temporary workaround, consider restricting access to sensitive information and monitoring system activity for signs of exploitation until a patch is applied.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Chakracore
Edge
Internet Explorer
Windows 10
Windows 7
Windows 8.1
Windows Rt 8.1
Windows Server 2008
Windows Server 2012
Windows Server 2016