Vulnerability Details : CVE-2017-0141
Potential exploit
A remote code execution vulnerability exists in the way affected Microsoft scripting engines render when handling objects in memory in Microsoft browsers. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. This vulnerability is different from those described in CVE-2017-0010, CVE-2017-0015, CVE-2017-0032, CVE-2017-0035, CVE-2017-0067, CVE-2017-0070, CVE-2017-0071, CVE-2017-0094, CVE-2017-0131, CVE-2017-0132, CVE-2017-0133, CVE-2017-0134, CVE-2017-0136, CVE-2017-0137, CVE-2017-0138, CVE-2017-0150, and CVE-2017-0151.
Vulnerability category: Execute code
Products affected by CVE-2017-0141
- cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*When used together with: Microsoft » Windows 10
Exploit prediction scoring system (EPSS) score for CVE-2017-0141
35.85%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-0141
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
7.6
|
HIGH | AV:N/AC:H/Au:N/C:C/I:C/A:C |
4.9
|
10.0
|
NIST | |
7.5
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.6
|
5.9
|
NIST |
References for CVE-2017-0141
-
http://www.securityfocus.com/bid/96685
Microsoft Edge CVE-2017-0141 Scripting Engine Remote Memory Corruption VulnerabilityThird Party Advisory;VDB Entry
-
http://packetstormsecurity.com/files/172826/Microsoft-ChakaCore-Remote-Code-Execution.html
Microsoft ChakaCore Remote Code Execution ≈ Packet Storm
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0141
CVE-2017-0141 | Scripting Engine Memory Corruption VulnerabilityPatch;Vendor Advisory
-
http://www.securitytracker.com/id/1038006
Microsoft Edge Multiple Flaws Let Remote Users Bypass Security Restrictions, Spoof URLs, Obtain Potentially Sensitive Information, and Execute Arbitrary Code - SecurityTracker
Jump to