CERT-In Vulnerability Note
CIVN-2018-0204
Multiple vulnerabilities in Microsoft Edge
Original Issue Date:December 12, 2018
Severity Rating: HIGH
Software Affected
- Windows 10 Version 1607 for 32-bit and x64-based Systems
- Windows 10 for 32-bit and x64-based Systems
- Windows Server 2016
- Windows 10 Version 1703 for 32-bit and x64-based Systems
- Windows 10 Version 1709 for 32-bit and 64-based Systems
- Windows 10 Version 1803 for 32-bit and x64-based Systems
- Windows 10 Version 1803 for ARM64-based Systems
- Windows 10 Version 1809 for 32-bit and x64-based Systems
- Windows 10 Version 1809 for ARM64-based Systems
- Windows Server 2019
- Windows 10 Version 1709 for ARM64-based Systems
Overview
Multiple vulnerabilities have been reported in Microsoft Edge which could be exploited by remote attacker to execute arbitrary code on the targeted system.
Description
1. Chakra Scripting Engine Memory Corruption Vulnerability
(
CVE-2018-8583
CVE-2018-8617
CVE-2018-8618
CVE-2018-8624
CVE-2018-8629
)
Multiple memory corruption vulnerabilities exist in Microsoft Edge due to improper handling of objects in the memory by the chakra scripting engine. A remote attacker could exploit these vulnerabilities by convincing a user to visit a specially crafted website to trigger memory corruption.
Successful exploitation of these vulnerabilities could allow a remote attacker to execute arbitrary code on the targeted system.
Solution
Apply appropriate patches as mentioned in Microsoft Security Bulletin
https://portal.msrc.microsoft.com/en-US/security-guidance
Vendor Information
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8583
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8617
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8618
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8624
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8629
References
Microsoft
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8583
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8617
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8618
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8624
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8629
CVE Name
CVE-2018-8583
CVE-2018-8617
CVE-2018-8618
CVE-2018-8624
CVE-2018-8629
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in
Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|