CVE-2017-11887

EUVD-2017-3482

12.12.2017, 21:29

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how Internet Explorer handle objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-11906 and CVE-2017-11919.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	NETWORK	HIGH	NONE	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 96%

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB4053581
1511 (x64, x86)	KB4053578
1607 (x64, x86)	KB4053579
1703 (x64, x86)	KB4053580

Windows 7

Service Pack 1 (x64, x86)	KB4052978
Service Pack 1 (x64, x86)	KB4054518

Windows 8.1

(x64, x86)	KB4052978
(x64, x86)	KB4054519

Windows RT 8.1

All

KB4054519

Windows Server 2008

Service Pack 2 (x64, x86)

KB4052978

Windows Server 2008 R2

Service Pack 1 (x64)	KB4052978
Service Pack 1 (x64)	KB4054518

Windows Server 2012

Standard	KB4054520
Standard	KB4052978

Windows Server 2012 R2

Standard	KB4052978
Standard	KB4054519

Windows Server 2016

Standard

KB4053579

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://www.securityfocus.com/bid/102063

http://www.securitytracker.com/id/1039993

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11887

http://www.securityfocus.com/bid/102063

http://www.securitytracker.com/id/1039993

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11887