CVE-2017-0134
HighSummary
CVE-2017-0134 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
Risk Assessment
If the current user has administrative rights, an attacker could take control of the affected system, install programs, modify or delete data, and create new accounts with full user rights.
Recommendation
It is recommended to update Microsoft software to the latest version to patch this vulnerability and to restrict access to systems for users with administrative privileges.
Other vulnerabilities in Silniki skryptowe Microsoftu
See all- CVE-2017-0151High
CVE-2017-0151 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0150High
CVE-2017-0150 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0141High
CVE-2017-0141 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0133High
CVE-2017-0133 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0132High
CVE-2017-0132 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0131High
CVE-2017-0131 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0070High
CVE-2017-0070 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.
- CVE-2017-0067High
CVE-2017-0067 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker who successfully exploits this vulnerability could gain user rights, and if the current user has administrative rights, they could take full control of the affected system.
- CVE-2017-0035High
CVE-2017-0035 is a remote code execution vulnerability in Microsoft scripting engines that can lead to unauthorized access to the system. An attacker who successfully exploits this vulnerability can gain user rights, allowing full control if the account is administrative.
- CVE-2017-0015High
CVE-2017-0015 is a remote code execution vulnerability in Microsoft scripting engines that improperly handle objects in memory. An attacker can exploit this vulnerability to execute arbitrary code in the context of the current user.
Original NVD description (English source)
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0141, CVE-2017-0150, and CVE-2017-0151.