Remote Code Execution (RCE)

Microsoft ChakraCore is vulnerable to remote code execution. This is due a lack of validation for return objects without any properties in AsmJs.cpp, which would allow a remote attacker to execute arbitrary code in the context of the authenticated user. This CVE ID is different from CVE-2017-0015...

Patch Tuesday - August 2017

It was a busy month this month with a total of 48 security issues fixed. All of these have a severity of Critical or Important with Remote Code Execution vulnerabilities again figuring highly, particularly for Microsoft Edge. There were also a few publicly disclosed vulnerabilities that were fixe...

Microsoft Edge Charkra Incorrect Jit Optimization Exploit

Exploit for windows platform in category dos / poc Microsoft Edge: Chakra incorrect jit optimization with TypedArray setter. CVE-2017-0071 PoC: "use strict"; function funca, b, c a0 = 1.2; b0 = c; a0 = ; ----------------------- 2 return 0; ; a0.toString; main; In the above code, Chakra assumes th...

CVE-2017-0071

CVE-2017-0134 is tied to a remote code execution vulnerability in Microsoft Edge’s scripting engine, arising from how in-memory objects are handled. The checkpoint advisory CPAI-2018-0053 states that a remote, unauthenticated attacker could lure a user to a crafted page to trigger memory corrupti...

Microsoft Edge Charkra Incorrect Jit Optimization

Microsoft Edge: Chakra incorrect jit optimization with TypedArray setter. CVE-2017-0071 PoC: "use strict"; function funca, b, c a0 = 1.2; b0 = c; a0 = ; ----------------------- 2 return 0; ; a0.toString; main; In the above code, Chakra assumes that the type of |a| will be still a native float arr...

KLA10968 Multiple vulnerabilities in Microsoft Edge

Multiple serious vulnerabilities have been found in Microsoft Edge. Malicious users can exploit these vulnerabilities to execute arbitrary code, gain privileges, obtain sensitive information and bypass security restrictions. Below is a complete list of vulnerabilities: 1. An incorrect handling of...

MS17-007: Cumulative Security Update for Microsoft Edge (4013071)

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 4013071. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by...