CVE-2017-11889
HighSummary
ChakraCore and Microsoft Edge in Windows 10 and Windows Server 2016 have a vulnerability that allows an attacker to execute arbitrary code in the context of the current user. The issue arises from improper handling of objects in memory by the scripting engine.
Risk Assessment
This vulnerability could lead to serious security breaches, allowing attackers to gain control over the user's system. Consequently, the organization may be at risk of data loss and other attacks.
Recommendation
It is recommended to update systems to the latest versions that include security patches. Additionally, monitoring and restricting access to applications that may be vulnerable to this issue is advisable.
Other vulnerabilities in ChakraCore, Microsoft Edge
See all- CVE-2017-11918High
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
- CVE-2017-11914High
ChakraCore and Microsoft Edge in Windows 10 (1511, 1607, 1703, 1709) and Windows Server 2016 have a vulnerability that allows an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
- CVE-2017-11905High
ChakraCore and Microsoft Edge in Windows 10 (1511, 1607, 1703, 1709) and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
- CVE-2017-11893High
ChakraCore and Microsoft Edge in Windows 10 (1511, 1607, 1703, 1709) and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
- CVE-2017-11873High
ChakraCore and Microsoft Edge in Windows 10 and Windows Server allow an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
- CVE-2017-11871High
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
- CVE-2017-11870High
ChakraCore and Microsoft Edge in Windows 10 1703, 1709, and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
- CVE-2017-11862High
ChakraCore and Microsoft Edge in Windows 10 1709 and Windows Server, version 1709 allow an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.
- CVE-2017-11840High
ChakraCore and Microsoft Edge in Windows 10 and Windows Server allow an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.
- CVE-2017-11836High
ChakraCore and Microsoft Edge in Windows 10 and Windows Server have a vulnerability that allows an attacker to take control of the system due to improper handling of objects in memory by the scripting engine.
Original NVD description (English source)
ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11914, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.