CVE-2017-0093
A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory in Microsoft browsers.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 13.7%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0201.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- EPSS
- 13.69% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-119
- Affected
- microsoft/edge
- Source
- secure@microsoft.com
References
- http://www.securityfocus.com/bid/97419Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038234
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0093Patch, Vendor Advisory
- http://www.securityfocus.com/bid/97419Third Party Advisory, VDB Entry
- http://www.securitytracker.com/id/1038234
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0093Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.