Vulnerability Name: | CVE-2017-11843 (CCN-134264) |
Assigned: | 2017-11-14 |
Published: | 2017-11-14 |
Updated: | 2017-12-01 |
Summary: | ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.
|
CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) 6.7 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)Exploitability Metrics: | Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): Required | Scope: | Scope (S): Unchanged
| Impact Metrics: | Confidentiality (C): High Integrity (I): High Availibility (A): High | 4.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N) 3.8 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:P/RL:O/RC:C)Exploitability Metrics: | Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): Required | Scope: | Scope (S): Unchanged
| Impact Metrics: | Confidentiality (C): Low Integrity (I): Low Availibility (A): None |
|
CVSS v2 Severity: | 7.6 High (CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)Exploitability Metrics: | Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): None | Impact Metrics: | Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete | 3.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:N)Exploitability Metrics: | Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): Single_Instance
| Impact Metrics: | Confidentiality (C): Partial Integrity (I): Partial Availibility (A): None |
|
Vulnerability Type: | CWE-119
|
Vulnerability Consequences: | Gain Access |
References: | Source: MITRE Type: CNA CVE-2017-11843
Source: BID Type: Third Party Advisory, VDB Entry 101740
Source: CCN Type: BID-101740 Microsoft Internet Explorer and Edge CVE-2017-11843 Remote Memory Corruption Vulnerability
Source: SECTRACK Type: Third Party Advisory, VDB Entry 1039780
Source: SECTRACK Type: Third Party Advisory, VDB Entry 1039781
Source: XF Type: UNKNOWN ms-browsers-cve201711843-code-exec(134264)
Source: CCN Type: Microsoft Security TechCenter - November 2017 Security Update Guide - November 2017 Security Updates
Source: CONFIRM Type: Patch, Vendor Advisory https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11843
|
Vulnerable Configuration: | Configuration 1: cpe:/a:microsoft:chakracore:*:*:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:*:*:*:*:*:*:*:*AND cpe:/o:microsoft:windows_7:*:sp1:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Configuration 2: cpe:/a:microsoft:edge:*:*:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:*:*:*:*:*:*:*:*AND cpe:/o:microsoft:windows_10:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1511:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1607:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1703:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1709:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:* Configuration CCN 1: cpe:/a:microsoft:internet_explorer:9:*:*:*:*:*:*:*OR cpe:/a:microsoft:ie:10:*:*:*:*:*:*:*OR cpe:/a:microsoft:edge:*:*:*:*:*:*:*:*OR cpe:/a:microsoft:chakracore:*:*:*:*:*:*:*:*AND cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_7:-:sp1:-:*:-:-:x32:*OR cpe:/o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x32:*OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x32:*OR cpe:/o:microsoft:windows_10:*:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server:1709:*:*:*:*:*:*:* Denotes that component is vulnerable |
BACK |
microsoft chakracore *
microsoft internet explorer *
microsoft windows 7 * sp1
microsoft windows 8.1 *
microsoft windows rt 8.1 *
microsoft windows server 2008 * sp2
microsoft windows server 2008 r2 sp1
microsoft windows server 2012 *
microsoft windows server 2012 r2
microsoft edge *
microsoft internet explorer *
microsoft windows 10 *
microsoft windows 10 1511
microsoft windows 10 1607
microsoft windows 10 1703
microsoft windows 10 1709
microsoft windows server 2016 *
microsoft windows server 2016 1709
microsoft ie 9
microsoft ie 10
microsoft edge *
microsoft chakracore *
microsoft windows server 2008 sp2
microsoft windows server 2008 sp2
microsoft windows 7 - sp1
microsoft windows 7 * sp1
microsoft windows server 2008 r2
microsoft windows server 2012
microsoft windows 8.1 - -
microsoft windows 8.1 *
microsoft windows server 2012 r2
microsoft windows rt 8.1 *
microsoft windows 10 -
microsoft windows 10 *
microsoft windows server 2016
microsoft windows server 1709