CVE-2018-1000 — Out-of-bounds Write in Microsoft Internet Explorer 10

CWE-787 — Out-of-bounds WriteCWE-200 — Sensitive Information ExposureCWE-93 — CRLF Injection22 documents10 sources
Severity
5.3MEDIUMNVD
GHSA7.5
EPSS
31.6%
top 3.20%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Microsoft Internet Explorer 10Microsoft Internet Explorer 11Microsoft Internet Explorer 9+1 more
Timeline
PublishedApr 12
Latest updateJul 21

Description

An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-0989.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages4 packages

▶CVEListV5microsoft/internet_explorer_9Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2+1
▶CVEListV5microsoft/internet_explorer_10Windows Server 2012
▶CVEListV5microsoft/internet_explorer_1118 versions+17

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
undici before v5.8.0 vulnerable to CRLF injection in request headers↗2022-07-21
▶
GHSA
GHSA-mh63-77cm-cvj3: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng↗2022-05-13
▶
CVEList
CVE-2018-1000: An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Eng↗2018-04-12
▶

💥Exploits & PoCs

6
Exploit-DB
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Incorrect Access Control Authentication Bypass↗2018-12-04
▶
Exploit-DB
Rockwell Automation Allen-Bradley PowerMonitor 1000 - Cross-Site Scripting↗2018-12-03
▶
Exploit-DB
Cisco Immunet < 6.2.0 / Cisco AMP For Endpoints 6.2.0 - Denial of Service↗2018-11-13
▶
Exploit-DB
Apple macOS 10.13.4 - Denial of Service (PoC)↗2018-09-12
▶
Exploit-DB
Delta Industrial Automation COMMGR 1.08 - Stack Buffer Overflow (PoC)↗2018-07-02
▶

📋Vendor Advisories

5
Chrome
Stable Channel Update for Desktop: CVE-2020-6431↗2020-04-07
▶
Chrome
Stable Channel Update for Desktop: CVE-2020-6500↗2020-02-04
▶
Chrome
Stable Channel Update for Desktop: CVE-2019-13743↗2019-12-10
▶
Red Hat
kernel: Infoleak caused by incorrect handling of the SG_IO ioctl↗2018-05-18
▶
Microsoft
Scripting Engine Memory Corruption Vulnerability↗2018-04-10
▶
CVE-2018-1000 — Out-of-bounds Write in Microsoft | cvebase