Vulnerability detail
Enriched intelligence for a single CVE
High
CVE-2017-0037
PUBLISHEDMicrosoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the...
- Vendor
- Microsoft Corporation
- Product
- Internet Browser
- Published
- Feb 26, 2017
- EPSS
- —
Description
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.
CVSS scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
AV:N/AC:H/Au:N/C:C/I:C/A:C
Exploitation status
Exploited in the wild
Recorded 2022-03-28 00:00:00 UTC · Source
SSVC decision points
- Exploitation
- active
- Automatable
- No
- Technical impact
- total
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1011
- https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html
- http://www.securityfocus.com/bid/96088
- https://www.exploit-db.com/exploits/41454/
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037
- https://www.exploit-db.com/exploits/43125/
- http://www.securitytracker.com/id/1037905
- https://www.exploit-db.com/exploits/42354/
- http://www.securitytracker.com/id/1037906
Known exploited vulnerability sources
Catalogues that list this CVE as a known exploited vulnerability.
| Source | Added |
|---|---|
| CISA | Mar 28, 2022 |
Potential proof of concepts
These PoCs are unverified and could contain malware. Use at your own risk.
github · Created 2022-03-28 01:19:58 UTC · 0 stars
Timeline
-
CVE ID Reserved
-
CVE Published to Public
-
Added to KEVIntel