CVSS: 7.6EPSS: 93%CPEs: 9EXPL: 1CVE-2017-11873 – Microsoft Edge Chakra: JIT - 'OP_Memset' Type Confusion
https://notcve.org/view.php?id=CVE-2017-11873
ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, and CVE-2017-11871. ChakraCore y Microsoft Edge en Windows 10 1511, 1607, 1703, 1709, Windows Server 2016 y Windows Server 1709 permiten que un atacante obtenga los mismos derechos de usuario que el usuario actual, debido a la forma en la que el motor de scripting gestiona los objetos en la memoria. Esto también se conoce como "Scripting Engine Memory Corruption Vulnerability". El ID de este CVE es diferente de CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870 y CVE-2017-11871. • https://www.exploit-db.com/exploits/43154 http://www.securityfocus.com/bid/101728 http://www.securitytracker.com/id/1039780 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11873 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.6EPSS: 91%CPEs: 7EXPL: 1CVE-2017-11839 – Microsoft Edge Chakra JIT - 'BailOutOnTaggedValue' Bailouts Type Confusion
https://notcve.org/view.php?id=CVE-2017-11839
Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to take control of an affected system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873. Microsoft Edge en Windows 10 Gold, 1511, 1607, 1703 y 1709, Windows Server 2016 y Windows Server en su versión 1709 permite que un atacante tome el control de un sistema afectado debido a la manera en la que el motor de scripting gestiona los objetos en la memoria. Esta vulnerabilidad también se conoce como "Scripting Engine Memory Corruption Vulnerability". El ID de este CVE es diferente de CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11858, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871 y CVE-2017-11873. • https://www.exploit-db.com/exploits/43180 http://www.securityfocus.com/bid/101735 http://www.securitytracker.com/id/1039780 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11839 • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-14823 – Foxit Reader XFA Signature Object signer Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-14823
The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. ... El problema deriva de la falta de validación correcta de información proporcionada por el usuario, lo que puede dar como resultado una condición de confusión de tipos. ... The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. • https://www.foxitsoftware.com/support/security-bulletins.php https://zerodayinitiative.com/advisories/ZDI-17-867 • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-14826 – Foxit Reader XFA Nodes formNodes Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-14826
The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. ... El problema deriva de la falta de validación correcta de información proporcionada por el usuario, lo que puede dar como resultado una condición de confusión de tipos. ... The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. • https://www.foxitsoftware.com/support/security-bulletins.php https://zerodayinitiative.com/advisories/ZDI-17-870 • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •
CVSS: 8.8EPSS: 1%CPEs: 1EXPL: 0CVE-2017-14825 – Foxit Reader XFAScriptObject remove Type Confusion Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-14825
The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. ... El problema deriva de la falta de validación correcta de información proporcionada por el usuario, lo que puede dar como resultado una condición de confusión de tipos. ... The issue results from the lack of proper validation of user-supplied data, which can result in a type confusion condition. • https://www.foxitsoftware.com/support/security-bulletins.php https://zerodayinitiative.com/advisories/ZDI-17-869 • CWE-704: Incorrect Type Conversion or Cast CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') •