Kaspersky LabKLA11070KLA11070 Multiple vulnerabilities in Microsoft Edge and Microsoft Internet Explorer
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
7.6 High
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
0.955 High
EPSS
Percentile
99.4%
Detect date:
07/11/2017
Severity:
Critical
Description:
Multiple serious vulnerabilities have been found in Microsoft Edge and Microsoft Internet Explorer. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code and spoof user interface.
Affected products:
Internet Explorer 9
Internet Explorer 10
Internet Explorer 11
Microsoft Edge
Microsoft Windows 10
Microsoft Windows 7 Service Pack 1
Microsoft Windows 8.1
Microsoft Windows RT 8.1
Microsoft Windows Server 2008 Service Pack 2
Microsoft Windows Server 2008 R2 Service Pack 1
Microsoft Windows Server 2012
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2016
Solution:
Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories:
CVE-2017-8618
CVE-2017-8619
CVE-2017-8599
CVE-2017-8598
CVE-2017-8617
CVE-2017-8603
CVE-2017-8592
CVE-2017-8601
CVE-2017-8602
CVE-2017-8607
CVE-2017-8596
CVE-2017-8595
CVE-2017-8604
CVE-2017-8609
CVE-2017-8608
CVE-2017-8605
CVE-2017-8611
CVE-2017-8606
CVE-2017-8594
CVE-2017-8610
CVE-2017-8592
CVE-2017-8594
CVE-2017-8595
CVE-2017-8596
CVE-2017-8598
CVE-2017-8599
CVE-2017-8601
CVE-2017-8602
CVE-2017-8603
CVE-2017-8604
CVE-2017-8605
CVE-2017-8606
CVE-2017-8607
CVE-2017-8608
CVE-2017-8609
CVE-2017-8610
CVE-2017-8611
CVE-2017-8617
CVE-2017-8618
CVE-2017-8619
Impacts:
ACE
Related products:
CVE-IDS:
CVE-2017-85924.3Warning
CVE-2017-85947.6Critical
CVE-2017-85957.6Critical
CVE-2017-85967.6Critical
CVE-2017-85987.6Critical
CVE-2017-85994.3Warning
CVE-2017-86017.6Critical
CVE-2017-86024.3Warning
CVE-2017-86037.6Critical
CVE-2017-86047.6Critical
CVE-2017-86057.6Critical
CVE-2017-86067.6Critical
CVE-2017-86077.6Critical
CVE-2017-86087.6Critical
CVE-2017-86097.6Critical
CVE-2017-86107.6Critical
CVE-2017-86114.3Warning
CVE-2017-86177.6Critical
CVE-2017-86187.6Critical
CVE-2017-86197.6Critical
Microsoft official advisories:
KB list:
4038788
4038782
4038783
4038781
4025342
4025339
4025344
4025338
4025331
4025336
4025341
4025252
Exploitation:
Public exploits exist for this vulnerability.
References
support.microsoft.com/kb/4025252
support.microsoft.com/kb/4025331
support.microsoft.com/kb/4025336
support.microsoft.com/kb/4025338
support.microsoft.com/kb/4025339
support.microsoft.com/kb/4025341
support.microsoft.com/kb/4025342
support.microsoft.com/kb/4025344
support.microsoft.com/kb/4038781
support.microsoft.com/kb/4038782
support.microsoft.com/kb/4038783
support.microsoft.com/kb/4038788
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8592
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8594
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8595
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8596
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8598
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8599
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8601
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8602
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8603
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8604
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8605
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8606
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8607
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8608
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8609
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8610
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8611
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8617
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8618
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8619
portal.msrc.microsoft.com/en-us/security-guidance
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8592
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8592
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8594
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8594
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8595
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8595
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8596
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8596
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8598
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8598
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8599
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8599
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8601
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8601
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8602
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8602
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8603
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8603
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8604
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8604
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8605
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8605
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8606
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8606
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8607
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8607
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8608
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8608
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8609
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8609
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8610
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8610
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8611
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8611
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8617
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8617
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8618
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8618
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8619
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8619
statistics.securelist.com/vulnerability-scan/month
threats.kaspersky.com/en/class/Exploit/
threats.kaspersky.com/en/product/Microsoft-Edge/
threats.kaspersky.com/en/product/Microsoft-Internet-Explorer/
threats.kaspersky.com/en/product/Microsoft-VBScript-engine/
threats.kaspersky.com/en/product/Microsoft-Windows-10/
threats.kaspersky.com/en/product/Microsoft-Windows-7/
threats.kaspersky.com/en/product/Microsoft-Windows-8/
threats.kaspersky.com/en/product/Microsoft-Windows-Server-2008/
threats.kaspersky.com/en/product/Microsoft-Windows-Server-2012/
threats.kaspersky.com/en/product/Windows-RT/
Related
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
7.6 High
CVSS2
Access Vector
NETWORK
Access Complexity
HIGH
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:H/Au:N/C:C/I:C/A:C
0.955 High
EPSS
Percentile
99.4%