7.5Alta
KEV
Usada en ransomware
CVE-2019-0752Microsoft Internet Explorer Type Confusion Vulnerability
Explotación conocida — Microsoft Internet Explorer Type Confusion Vulnerability
CISA confirmó el 15.02.2022 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 15.08.2022.
Acción requerida: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2019-0752
Descripción
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
Debilidad (CWE):
CWE-843
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| microsoft | internet explorer | 11 | |
| Microsoft | Internet Explorer 10 | Windows Server 2012 | |
| Microsoft | Internet Explorer 11 | Windows 7 for 32-bit Systems Service Pack 1, Windows 7 for x64-based Systems Service Pack 1, Windows Server 2008 R2 for x64-based Systems Service Pack 1, Windows 8.1 for 32-bit systems, Windows 8.1 for x64-based systems, Windows Server 2012 R2, Windows RT 8.1, Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems, Windows Server 2016, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1703 for 32-bit Systems, Windows 10 Version 1703 for x64-based Systems, Windows 10 Version 1709 for 32-bit Systems, Windows 10 Version 1709 for |
Referencias y parches
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0752 PatchVendor Advisory
- https://www.zerodayinitiative.com/advisories/ZDI-19-359/ Third Party AdvisoryVDB Entry
- http://packetstormsecurity.com/files/153078/Microsoft-Internet-Explorer-Windows-10-1809-17763.316-Memory-Corr… ExploitThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0752 US Government Resource
Coincidencias CPE (NVD) (2)
cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*