CVE-2018-0836 — Out-of-bounds Write in Corporation Internet Explorer

CWE-787 — Out-of-bounds Write39 documents6 sources
Severity
7.5HIGHNVD
EPSS
28.4%
top 3.47%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
7
Microsoft Corporation Internet ExplorerMicrosoft Internet ExplorerMsrc Chakracore+4 more
Timeline
PublishedFeb 15
Latest updateMay 13

Description

Microsoft Edge and ChakraCore in Microsoft Windows 10 1703 and 1709 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0859, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages7 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

23
OSV
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
GHSA-6cff-v7rr-93p7: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8↗2022-05-13
▶
OSV
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
ChakraCore RCE Vulnerability↗2022-05-13
▶

📋Vendor Advisories

1
Microsoft
Scripting Engine Memory Corruption Vulnerability↗2018-02-13
▶

🕵️Threat Intelligence

2
Talos
Microsoft Patch Tuesday - February 2018↗2018-02-13
▶
Talos
Microsoft Patch Tuesday - February 2018↗2018-02-13
▶