Description
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Microsoft Corporation Internet Browser
Internet Explorer 10 and 11 and Edgeaffected
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1011 ↗
- https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html ↗
- http://www.securityfocus.com/bid/96088 ↗
- https://www.exploit-db.com/exploits/41454/ ↗
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037 ↗
- https://www.exploit-db.com/exploits/43125/ ↗
- http://www.securitytracker.com/id/1037905 ↗
- https://www.exploit-db.com/exploits/42354/ ↗
- http://www.securitytracker.com/id/1037906 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0037 ↗