| Vulnerability Name: | CVE-2017-8641 (CCN-129379) |
| Assigned: | 2017-08-08 |
| Published: | 2017-08-08 |
| Updated: | 2017-08-20 |
| Summary: | Microsoft browsers in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8671, CVE-2017-8672, and CVE-2017-8674.
|
| CVSS v3 Severity: | 7.5 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H)
6.5 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): High
Availibility (A): High |
4.2 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N)
3.7 Low (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): Required | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None |
|
| CVSS v2 Severity: | 7.6 High (CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:C/A:C)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): High
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete |
3.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): Single_Instance
| | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None |
|
| Vulnerability Type: | CWE-119
|
| Vulnerability Consequences: | Gain Access |
| References: | Source: MITRE
Type: CNA
CVE-2017-8641
Source: BID
Type: Third Party Advisory, VDB Entry
100057
Source: CCN
Type: BID-100057
Microsoft Internet Explorer and Edge CVE-2017-8641 Remote Memory Corruption Vulnerability
Source: SECTRACK
Type: Third Party Advisory, VDB Entry
1039095
Source: XF
Type: UNKNOWN
ms-browsers-cve20178641-code-exec(129379)
Source: CCN
Type: Packet Storm Security [08-21-2017]
Microsoft Edge Chakra chakra!Js::GlobalObject Integer Overflow
Source: CCN
Type: Microsoft Security TechCenter - August 2017
Scripting Engine Memory Corruption Vulnerability
Source: CONFIRM
Type: Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8641
Source: EXPLOIT-DB
Type: EXPLOIT
Offensive Security Exploit Database [08-17-2017]
Source: EXPLOIT-DB
Type: UNKNOWN
42465
Source: CCN
Type: ZDI-17-641
Microsoft Chakra eval Integer Overflow Remote Code Execution Vulnerability
|
| Vulnerable Configuration: | Configuration 1:
cpe:/a:microsoft:edge:*:*:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:9:*:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:10:*:*:*:*:*:*:*OR cpe:/a:microsoft:internet_explorer:11:*:*:*:*:*:*:*AND cpe:/o:microsoft:windows_10:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1511:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1607:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:1703:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_7:*:sp1:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/a:microsoft:internet_explorer:9:*:*:*:*:*:*:*OR cpe:/a:microsoft:ie:10:*:*:*:*:*:*:*OR cpe:/a:microsoft:edge:*:*:*:*:*:*:*:*AND cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:*OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_7:-:sp1:-:*:-:-:x32:*OR cpe:/o:microsoft:windows_7:*:sp1:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x32:*OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x32:*OR cpe:/o:microsoft:windows_10:*:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
 Denotes that component is vulnerable |
| BACK |
microsoft edge *
microsoft internet explorer 9
microsoft internet explorer 10
microsoft internet explorer 11
microsoft windows 10 -
microsoft windows 10 1511
microsoft windows 10 1607
microsoft windows 10 1703
microsoft windows 7 * sp1
microsoft windows 8.1 *
microsoft windows rt 8.1 *
microsoft windows server 2008 * sp2
microsoft windows server 2008 r2 sp1
microsoft windows server 2012 *
microsoft windows server 2012 r2
microsoft windows server 2016 *
microsoft ie 9
microsoft ie 10
microsoft edge *
microsoft windows server 2008 sp2
microsoft windows server 2008 sp2
microsoft windows 7 - sp1
microsoft windows 7 * sp1
microsoft windows server 2008 r2
microsoft windows server 2012
microsoft windows 8.1 - -
microsoft windows 8.1 *
microsoft windows server 2012 r2
microsoft windows rt 8.1 *
microsoft windows 10 -
microsoft windows 10 *
microsoft windows server 2016