Kaspersky Threats

CVSS

?

9.3

Detect date

?

09/12/2017

Severity

?

Critical

Description

Multiple serious vulnerabilities have been found in Microsoft Edge and Microsoft Internet Explorer. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, bypass security restrictions and spoof user interface.

Below is a complete list of vulnerabilities:

Multiple vulnerabilities related to improper handling of objects in memory in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
An improper handling of clipboard events in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
An incorrect parent domain verification in Microsoft browsers can be exploited remotely via a specially designed website to obtain sensitive information;
An incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
Multiple vulnerabilities related to incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to execute arbitrary code;
Multiple vulnerabilities related to improper access of objects in memory in Microsoft browsers can be exploited remotely via a specially designed website to execute arbitrary code;
Multiple vulnerabilities related to improper handling of objects in memory in JavaScript engines in Microsoft browsers during rendering content can be exploited remotely via a specially designed website to execute arbitrary code;
Multiple vulnerabilities related to improper validation of documents in Microsoft Edge can be exploited remotely via a specially designed website to bypass security restrictions;
Multiple vulnerabilities related to incorrect parsing of HTTP content in Microsoft Edge can be exploited remotely via a specially designed website to spoof user interface;
An improper handling of HTTP content in Microsoft Internet Explorer can be exploited remotely via a specially designed website to spoof user interface;
Multiple vulnerabilities related to incorrect handling of objects in memory in Microsoft Windows PDF Library can be exploited remotely via a specially designed website to execute arbitrary code.

NB: Not every vulnerability already has CVSS rating, so cumulative CVSS rating can be not representative.

Affected products

Microsoft Internet Explorer versions 9 through 11
Microsoft Edge

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2017-8756
CVE-2017-8747
CVE-2017-8734
CVE-2017-8729
CVE-2017-8728
CVE-2017-8757
CVE-2017-8749
CVE-2017-8738
CVE-2017-11766
CVE-2017-8750
CVE-2017-8731
CVE-2017-8753
CVE-2017-8723
CVE-2017-8724
CVE-2017-8741
CVE-2017-8754
CVE-2017-8740
CVE-2017-8752
CVE-2017-8597
CVE-2017-8660
CVE-2017-8736
CVE-2017-11764
CVE-2017-8643
CVE-2017-8751
CVE-2017-8649
CVE-2017-8748
CVE-2017-8755
CVE-2017-8737
CVE-2017-8648
CVE-2017-8739
CVE-2017-8735
CVE-2017-8733

Impacts

?

ACE

[?]

OSI

[?]

DoS

[?]

SB

[?]

PE

[?]

SUI

[?]

CVSS ?	9.3
Detect date ?	09/12/2017
Severity ?	Critical
Description	Multiple serious vulnerabilities have been found in Microsoft Edge and Microsoft Internet Explorer. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, bypass security restrictions and spoof user interface. Below is a complete list of vulnerabilities: Multiple vulnerabilities related to improper handling of objects in memory in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information; An improper handling of clipboard events in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information; An incorrect parent domain verification in Microsoft browsers can be exploited remotely via a specially designed website to obtain sensitive information; An incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information; Multiple vulnerabilities related to incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to execute arbitrary code; Multiple vulnerabilities related to improper access of objects in memory in Microsoft browsers can be exploited remotely via a specially designed website to execute arbitrary code; Multiple vulnerabilities related to improper handling of objects in memory in JavaScript engines in Microsoft browsers during rendering content can be exploited remotely via a specially designed website to execute arbitrary code; Multiple vulnerabilities related to improper validation of documents in Microsoft Edge can be exploited remotely via a specially designed website to bypass security restrictions; Multiple vulnerabilities related to incorrect parsing of HTTP content in Microsoft Edge can be exploited remotely via a specially designed website to spoof user interface; An improper handling of HTTP content in Microsoft Internet Explorer can be exploited remotely via a specially designed website to spoof user interface; Multiple vulnerabilities related to incorrect handling of objects in memory in Microsoft Windows PDF Library can be exploited remotely via a specially designed website to execute arbitrary code. NB: Not every vulnerability already has CVSS rating, so cumulative CVSS rating can be not representative.
Affected products	Microsoft Internet Explorer versions 9 through 11 Microsoft Edge
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2017-8756 CVE-2017-8747 CVE-2017-8734 CVE-2017-8729 CVE-2017-8728 CVE-2017-8757 CVE-2017-8749 CVE-2017-8738 CVE-2017-11766 CVE-2017-8750 CVE-2017-8731 CVE-2017-8753 CVE-2017-8723 CVE-2017-8724 CVE-2017-8741 CVE-2017-8754 CVE-2017-8740 CVE-2017-8752 CVE-2017-8597 CVE-2017-8660 CVE-2017-8736 CVE-2017-11764 CVE-2017-8643 CVE-2017-8751 CVE-2017-8649 CVE-2017-8748 CVE-2017-8755 CVE-2017-8737 CVE-2017-8648 CVE-2017-8739 CVE-2017-8735 CVE-2017-8733
Impacts ?	ACE [?] OSI [?] DoS [?] SB [?] PE [?] SUI [?]
Related products	Microsoft Internet Explorer Microsoft Edge
CVE-IDS ?	CVE-2017-8756 CVE-2017-8747 CVE-2017-8734 CVE-2017-8729 CVE-2017-8728 CVE-2017-8757 CVE-2017-8749 CVE-2017-8738 CVE-2017-11766 CVE-2017-8750 CVE-2017-8731 CVE-2017-8753 CVE-2017-8723 CVE-2017-8724 CVE-2017-8741 CVE-2017-8754 CVE-2017-8740 CVE-2017-8752 CVE-2017-8597 CVE-2017-8660 CVE-2017-8736 CVE-2017-11764 CVE-2017-8643 CVE-2017-8751 CVE-2017-8649 CVE-2017-8748 CVE-2017-8755 CVE-2017-8737 CVE-2017-8648 CVE-2017-8739 CVE-2017-8735 CVE-2017-8733
Microsoft official advisories	Microsoft Security Update Guide
KB list	4038788 4038782 4038783 4038792 4038799 4038781 4038777 4036586