PT-2018-1546 · Microsoft · Office+3
Published
2018-09-10
·
Updated
2020-08-24
·
CVE-2018-8457
CVSS v2.0
7.6
High
| Vector | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Microsoft Edge (affected versions not specified)
Internet Explorer (affected versions not specified)
Description
The issue is related to errors in handling objects in memory by the JavaScript script handler ChakraCore in Microsoft browsers. Exploitation of this issue could allow a remote attacker to execute arbitrary code using a specially crafted web page, application, or Microsoft Office document. This could corrupt memory, enabling the attacker to gain the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights.
Recommendations
For Microsoft Edge, update to a version that includes the fix for this issue.
For Internet Explorer, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to potentially vulnerable web pages or documents until a patch is available.
Avoid using applications or features that rely on the vulnerable scripting engine until the issue is resolved.
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
RCE
Memory Corruption
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Chakracore
Edge
Internet Explorer
Office