CVE-2019-0609
Microsoft Internet Explorer 11
HIGH 7.5
En bref
- Source
- NVD
- EPSS
- EPSS 9.85 % · centile 96 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- microsoft
- Statut NVD
- Modified
Description
A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0639, CVE-2019-0680, CVE-2019-0769, CVE-2019-0770, CVE-2019-0771, CVE-2019-0773, CVE-2019-0783.
Faiblesses (CWE)
- CWE-787 — Écriture hors limites
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.0 | HIGH 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | HIGH 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-pjpj-f6r8-56rm — High severity vulnerability that affects Microsoft.ChakraCore
Références européennes
- ENISA EUVD · EUVD-2019-0426
- GCVE · GCVE-0-2019-0609
Avis du CERT-FR
- CERTFR-2019-AVI-106 — Multiples vulnérabilités dans les produits Microsoft · cert.ssi.gouv.fr
- CERTFR-2019-AVI-102 — Multiples vulnérabilités dans Microsoft Edge · cert.ssi.gouv.fr
- CERTFR-2019-AVI-101 — Multiples vulnérabilités dans Microsoft Internet Explorer · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*< 1.11.7cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Microsoft · Internet Explorer 11 | affected Windows 7 for 32-bit Systems Service Pack 1 ; affected Windows 7 for x64-based Systems Service Pack 1 ; affected Windows Server 2008 R2 for x64-based Systems Service Pack 1 ; affected Windows 8.1 for 32-bit systems ; affected Windows 8.1 for x64-based systems ; affected Windows Server 2012 R2 |
| Microsoft · Microsoft Edge | affected Windows RT 8.1 ; affected Windows 10 for 32-bit Systems ; affected Windows 10 for x64-based Systems ; affected Windows Server 2016 ; affected Windows 10 Version 1607 for 32-bit Systems ; affected Windows 10 Version 1607 for x64-based Systems |
| Microsoft · ChakraCore | affected Windows Server 2019 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |