Vulnerability Details : CVE-2017-8606
Microsoft browsers in Microsoft Windows 7, Windows Server 2008 and R2, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user when the JavaScript engines fail to render when handling objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8598, CVE-2017-8596, CVE-2017-8618, CVE-2017-8619, CVE-2017-8610, CVE-2017-8601, CVE-2017-8603, CVE-2017-8604, CVE-2017-8605, CVE-2017-8595, CVE-2017-8607, CVE-2017-8608, and CVE-2017-8609
Vulnerability category: OverflowMemory CorruptionExecute code
Exploit prediction scoring system (EPSS) score for CVE-2017-8606
Probability of exploitation activity in the next 30 days: 6.89%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 93 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2017-8606
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.6
|
HIGH | AV:N/AC:H/Au:N/C:C/I:C/A:C |
4.9
|
10.0
|
NIST |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.6
|
5.9
|
NIST |
CWE ids for CVE-2017-8606
-
The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-8606
-
http://www.securitytracker.com/id/1038848
Microsoft Internet Explorer Scripting Engine Object Memory Handling Errors Let Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securitytracker.com/id/1038849
Microsoft Edge Object Memory Handling Flaws in Scripting Engines Let Remote Users Execute Arbitrary Code - SecurityTrackerThird Party Advisory;VDB Entry
-
http://www.securityfocus.com/bid/99408
Microsoft Edge and Internet Explorer CVE-2017-8606 Remote Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
-
https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8606
CVE-2017-8606 | Scripting Engine Memory Corruption VulnerabilityPatch;Vendor Advisory
Products affected by CVE-2017-8606
- cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*When used together with: Microsoft » Windows 8.1When used together with: Microsoft » Windows Rt 8.1When used together with: Microsoft » Windows Server 2012When used together with: Microsoft » Windows Server 2016
- cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*When used together with: Microsoft » Windows 8.1When used together with: Microsoft » Windows Rt 8.1When used together with: Microsoft » Windows Server 2012When used together with: Microsoft » Windows Server 2016
- cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*When used together with: Microsoft » Windows 8.1When used together with: Microsoft » Windows Rt 8.1When used together with: Microsoft » Windows Server 2012When used together with: Microsoft » Windows Server 2016
- cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*When used together with: Microsoft » Windows 8.1When used together with: Microsoft » Windows Rt 8.1When used together with: Microsoft » Windows Server 2012When used together with: Microsoft » Windows Server 2016