Kaspersky ID:
KLA11098
Дата обнаружения:
12/09/2017
Обновлено:
22/01/2024

Описание

Multiple serious vulnerabilities have been found in Microsoft Edge and Microsoft Internet Explorer. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, bypass security restrictions and spoof user interface.

Below is a complete list of vulnerabilities:

  1. Multiple vulnerabilities related to improper handling of objects in memory in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
  2. An improper handling of clipboard events in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
  3. An incorrect parent domain verification in Microsoft browsers can be exploited remotely via a specially designed website to obtain sensitive information;
  4. An incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
  5. Multiple vulnerabilities related to incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to execute arbitrary code;
  6. Multiple vulnerabilities related to improper access of objects in memory in Microsoft browsers can be exploited remotely via a specially designed website to execute arbitrary code;
  7. Multiple vulnerabilities related to improper handling of objects in memory in JavaScript engines in Microsoft browsers during rendering content can be exploited remotely via a specially designed website to execute arbitrary code;
  8. Multiple vulnerabilities related to improper validation of documents in Microsoft Edge can be exploited remotely via a specially designed website to bypass security restrictions;
  9. Multiple vulnerabilities related to incorrect parsing of HTTP content in Microsoft Edge can be exploited remotely via a specially designed website to spoof user interface;
  10. An improper handling of HTTP content in Microsoft Internet Explorer can be exploited remotely via a specially designed website to spoof user interface;
  11. Multiple vulnerabilities related to incorrect handling of objects in memory in Microsoft Windows PDF Library can be exploited remotely via a specially designed website to execute arbitrary code.

NB: Not every vulnerability already has CVSS rating, so cumulative CVSS rating can be not representative.

Первичный источник обнаружения

Эксплуатация

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Связанные продукты

Список CVE

  • CVE-2017-8756
    critical
  • CVE-2017-8747
    critical
  • CVE-2017-8734
    critical
  • CVE-2017-8729
    critical
  • CVE-2017-8728
    critical
  • CVE-2017-8757
    critical
  • CVE-2017-8749
    critical
  • CVE-2017-8738
    critical
  • CVE-2017-11766
    critical
  • CVE-2017-8750
    critical
  • CVE-2017-8731
    critical
  • CVE-2017-8753
    critical
  • CVE-2017-8723
    warning
  • CVE-2017-8724
    warning
  • CVE-2017-8741
    critical
  • CVE-2017-8754
    warning
  • CVE-2017-8740
    critical
  • CVE-2017-8752
    critical
  • CVE-2017-8597
    warning
  • CVE-2017-8660
    critical
  • CVE-2017-8736
    warning
  • CVE-2017-11764
    critical
  • CVE-2017-8643
    warning
  • CVE-2017-8751
    critical
  • CVE-2017-8649
    critical
  • CVE-2017-8748
    critical
  • CVE-2017-8755
    critical
  • CVE-2017-8737
    critical
  • CVE-2017-8648
    warning
  • CVE-2017-8739
    warning
  • CVE-2017-8735
    warning
  • CVE-2017-8733
    warning

Список KB

Смотрите также

Узнай статистику распространения уязвимостей в своем регионе statistics.securelist.com

Нашли неточность в описании этой уязвимости? Дайте нам знать!
Kaspersky IT Security Calculator:
Оцените ваш профиль кибербезопасности
Узнать больше
Встречай новый Kaspersky!
Каждая минута твоей онлайн-жизни заслуживает топовой защиты.
Узнать больше
Confirm changes?
Your message has been sent successfully.