CVE-2018-8289
published 2018-07-11CVE-2018-8289: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure…
PriorityP422medium4.3CVSS 3.0
AVNACLPRNUIRSUCLINAN
EPSS
9.35%
94.9th percentile
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8297, CVE-2018-8324, CVE-2018-8325.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_edge | — | — |
| microsoft | microsoft_edge | — | — |
| msrc | microsoft_edge_on_windows_10_version_1803_for_32-bit_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1803_for_x64-based_systems | — | — |
CVSS provenance
nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_msrc4.2MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Edge based on Edge HTML Information Disclosure Vulnerability
vendor_msrc·2018-07-10·CVSS 4.2
CVE-2018-8289 [MEDIUM] Microsoft Edge based on Edge HTML Information Disclosure Vulnerability
Microsoft Edge based on Edge HTML Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists when Microsoft Edge based on Edge HTML improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
To exploit the vulnerability, in a web-based attack scenario, an attacker could host a website in an attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. However, in all cases an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to
GHSA
GHSA-645w-g9v6-7mvr: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
ghsa_unreviewed·2022-05-14·CVSS 4.3
CVE-2018-8297 [MEDIUM] CWE-200 GHSA-645w-g9v6-7mvr: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8289, CVE-2018-8324, CVE-2018-8325.
GHSA
GHSA-6436-xf58-6mvp: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
ghsa_unreviewed·2022-05-14·CVSS 4.3
CVE-2018-8325 [MEDIUM] CWE-200 GHSA-6436-xf58-6mvp: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8289, CVE-2018-8297, CVE-2018-8324.
GHSA
GHSA-8ccw-5hjp-6rg9: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
ghsa_unreviewed·2022-05-14·CVSS 4.3
CVE-2018-8289 [MEDIUM] CWE-200 GHSA-8ccw-5hjp-6rg9: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8297, CVE-2018-8324, CVE-2018-8325.
GHSA
GHSA-9cq7-rgrh-hrhc: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
ghsa_unreviewed·2022-05-14·CVSS 4.3
CVE-2018-8324 [MEDIUM] CWE-200 GHSA-9cq7-rgrh-hrhc: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vu
An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8289, CVE-2018-8297, CVE-2018-8325.
No detection rules found.
No public exploits indexed.
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits & Vulnerabilities
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro 2018/07/11 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vulner
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits y vulnerabilidades
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro Jul 11, 2018 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vul
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits & Vulnerabilities
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro Jul 11, 2018 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vuln
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Ausnutzung von Schwachstellen
## July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro Jul 11, 2018 Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280 , CVE-2018-8286 , CVE-2018-8290 , CVE-2018-8294 , and CVE-2018-8298 , all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304 , a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy v
Trendmicro
July Patch Tuesday: Large Adobe Security Update
blogs_trendmicro·2018-07-11·CVSS 5.3
CVE-2018-8280 [MEDIUM] July Patch Tuesday: Large Adobe Security Update
Exploits & Vulnerabilities
# July Patch Tuesday: Large Adobe Security Update
Patch Tuesday for July addresses 53 Microsoft and 107 Adobe vulnerabilities.
By: Trend Micro
2018/07/11
Read time: ( words)
Save to Folio
July’s Patch Tuesday addresses 53 vulnerabilities, including 18 critical ones, most of which involve Microsoft’s browsers. These include CVE-2018-8280, CVE-2018-8286, CVE-2018-8290, CVE-2018-8294, and CVE-2018-8298, all of which are corruption bugs in the Chakra Javascript Engine that exist in the way it handles objects in memory in Microsoft Edge. An attacker could then use a specially crafted website that could potentially provide administrative rights to the perpetrator.
CVE-2018-8304, a Windows DNSAPI Denial of Service Vulnerability, is another noteworthy vulnerabilit
Talos
Microsoft Patch Tuesday - July 2018
blogs_talos·2018-07-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - July 2018
Microsoft released its monthly set of security advisories today for vulnerabilities that have been identified and addressed in various products. This month's release addresses 53 new vulnerabilities, 17 of which are rated critical, 34 are rated important, one is rated moderate, and one is rated as low severity. These vulnerabilities impact Windows Operating System, Edge, Internet Explorer and more.
In addition to the 53 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180017, which addresses the vulnerabilities described in the Adobe security bulletin APSB18-24.
## Critical vulnerabilitiesThis month, Microsoft is addressing 17 vulnerabilities that are rated as critical:
CVE-2018-8242 - Scripting Engine Memory Corruption Vulnerability
CVE-2018-
Talos
Microsoft Patch Tuesday - July 2018
blogs_talos·2018-07-10·CVSS 7.5
[HIGH] Microsoft Patch Tuesday - July 2018
## Microsoft Patch Tuesday - July 2018
Microsoft released its monthly set of security advisories today for vulnerabilities that have been identified and addressed in various products. This month's release addresses 53 new vulnerabilities, 17 of which are rated critical, 34 are rated important, one is rated moderate, and one is rated as low severity. These vulnerabilities impact Windows Operating System, Edge, Internet Explorer and more.
In addition to the 53 vulnerabilities referenced above, Microsoft has also released a critical update advisory, ADV180017 , which addresses the vulnerabilities described in the Adobe security bulletin APSB18-24 .
## Critical vulnerabilities This month, Microsoft is addressing 17 vulnerabilities that are rated as critical:
CVE-2018-8242 - Scripting Engin
Zscaler
Zscaler protects against 13 new vulnerabilities for Scripting Engine & Microsoft Edge. | Zscaler
blogs_zscaler·CVSS 7.5
[HIGH] Zscaler protects against 13 new vulnerabilities for Scripting Engine & Microsoft Edge. | Zscaler
Provide users with seamless, secure, reliable access to applications and data.
Build and run secure cloud apps, enable zero trust cloud connectivity, and protect workloads from data center to cloud.
Provide zero trust connectivity for IoT and OT devices and secure remote access to OT systems.
Provide zero trust site-to-site connectivity and reliable access to B2B apps for partners.
Industry Report
Zscaler: A Leader in the 2025 Gartner® Magic Quadrant™ for Security Service Edge (SSE)
USE CASES
INDUSTRY & MARKET SOLUTIONS
PARTNERS
TECHNOLOGY PARTNERS
Resource Center
Events & Trainings
Security Research & Services
Tools
Community & Support
CXO REVOLUTIONARIES
Amplifying the voices of real-world digital and zero trust pioneers
Discover how it began and where it’s going
Meet o
http://www.securityfocus.com/bid/104628http://www.securitytracker.com/id/1041255https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8289http://www.securityfocus.com/bid/104628http://www.securitytracker.com/id/1041255https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8289
2018-07-11
Published