Back to KEVs

CVE-2017-0037

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the...

Basic Information

CVE State
PUBLISHED
Reserved Date
September 09, 2016
Published Date
February 26, 2017
Last Updated
February 10, 2025
Vendor
Microsoft Corporation
Product
Internet Browser
Description
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

CVSS Scores

CVSS v3.1

8.1 - HIGH

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

SSVC Information

Exploitation
active
Technical Impact
total

Exploit Status

Exploited in the Wild
Yes (added 2022-03-28 00:00:00 UTC) Source
Proof of Concept Available
Yes (added 2022-03-28 01:19:58 UTC) Source

References

https://bugs.chromium.org/p/project-zero/issues/detail?id=1011 https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html http://www.securityfocus.com/bid/96088 https://www.exploit-db.com/exploits/41454/ https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037 https://www.exploit-db.com/exploits/43125/ http://www.securitytracker.com/id/1037905 https://www.exploit-db.com/exploits/42354/ http://www.securitytracker.com/id/1037906

Known Exploited Vulnerability Information

Source Added Date
CISA 2022-03-28 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

chattopadhyaykittu/CVE-2017-0037

Type: github • Created: 2022-03-28 01:19:58 UTC • Stars: 0