PT-2017-12287 · Microsoft · Windows+2
Published
2017-12-12
·
Updated
2018-01-18
·
CVE-2017-11887
CVSS v3.1
5.3
Medium
| Vector | AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft Windows (affected versions not specified)
Internet Explorer (affected versions not specified)
Description
An information disclosure issue exists due to improper handling of objects in memory by Internet Explorer. This could allow an attacker to obtain information that could be used to further compromise the user's system. The issue is related to use-after-free vulnerabilities in VBScript, specifically involving the
Join function and Filter function, as well as VT BSTR use-after-free.Recommendations
For Microsoft Windows, apply the recommended patch or update from Microsoft to resolve the issue.
For Internet Explorer, consider disabling the use of VBScript or restricting access to it until a patch is available.
As a temporary workaround, consider avoiding the use of the
Join function and Filter function in VBScript until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Internet Explorer
Windows
Vbscript