CVE-2018-0859 — Out-of-bounds Write in Corporation Internet Explorer

CWE-787 — Out-of-bounds Write41 documents7 sources
Severity
7.5HIGHNVD
EPSS
29.3%
top 3.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
17
Microsoft Corporation Internet ExplorerMicrosoft Internet ExplorerMsrc Chakracore+14 more
Timeline
PublishedFeb 15
Latest updateMay 13

Description

Microsoft Edge and ChakraCore in Microsoft Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2018-0834, CVE-2018-0835, CVE-2018-0836, CVE-2018-0837, CVE-2018-0838, CVE-2018-0840, CVE-2018-0856, CVE-2018-0857, CVE-2018-0858, CVE-2018-0860, CVE-2018-0861, and CVE-2018-0866.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages17 packages

🔴Vulnerability Details

23
OSV
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
GHSA-6cff-v7rr-93p7: Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8↗2022-05-13
▶
OSV
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
ChakraCore RCE Vulnerability↗2022-05-13
▶
GHSA
ChakraCore RCE Vulnerability↗2022-05-13
▶

📋Vendor Advisories

1
Microsoft
Scripting Engine Memory Corruption Vulnerability↗2018-02-13
▶

🕵️Threat Intelligence

3
Securelist
New zero-day vulnerability CVE-2019-0859 in win32k.sys↗2019-04-15
▶
Talos
Microsoft Patch Tuesday - February 2018↗2018-02-13
▶
Talos
Microsoft Patch Tuesday - February 2018↗2018-02-13
▶