⚠ Actively exploited
Added to CISA KEV on 2022-05-24. Federal agencies required to patch by 2022-06-14. Required action: Apply updates per vendor instructions..
CVE-2017-0149 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Corporation Internet Explorer
Severity
8.8HIGHNVD
NVD7.5CNA7.5
EPSS
41.5%
top 2.59%
CISA KEV
KEV
Added 2022-05-24
Due 2022-06-14
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedMar 17
KEV addedMay 24
KEV dueJun 14
CISA Required Action: Apply updates per vendor instructions.
Description
Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability." This vulnerability is different from those described in CVE-2017-0018 and CVE-2017-0037.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages2 packages
▶CVEListV5microsoft_corporation/internet_explorerInternet Explorer 10 and 11, Internet Explorer 9 through 11+1
Patches
🔴Vulnerability Details
5GHSA▶
GHSA-8xx2-2w6g-2ff2: Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted↗2022-05-17
GHSA▶
GHSA-xqqj-2hmg-wc6r: Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft↗2022-05-17
CVEList▶
CVE-2017-0018: Microsoft Internet Explorer 10 and 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted↗2017-03-17
CVEList▶
CVE-2017-0149: Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craft↗2017-03-17