PT-2017-18449 · Microsoft · Windows 10+1

Ivan Fratric · Published 2017-08-08 · Updated 2019-10-03 · CVE-2017-8637

Positive Technologies (AI Summary)

CVSS v2.0

2.6

Low

Base vector

AV:N/AC:H/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge in Microsoft Windows 10 1703

Description A security feature bypass issue exists due to how Microsoft Edge accesses memory in code compiled by the Edge Just-In-Time (JIT) compiler, allowing Arbitrary Code Guard (ACG) to be bypassed. This issue does not allow arbitrary code execution on its own but could be used in conjunction with another vulnerability, such as a remote code execution vulnerability, to run arbitrary code on a target system. Exploitation requires a user to be logged on and running an affected version of Microsoft Edge, and then browse to a malicious website.

Recommendations For Microsoft Edge in Microsoft Windows 10 1703, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2017-8637

Affected Products

Edge

Windows 10

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2017-8637 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8637 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8637 · Vendor Advisory
• http://securitytracker.com/id/1039095 · Note
• http://securityfocus.com/bid/100045 · Note