CVE-2017-0149: high-severity vulnerability in Microsoft Corporation Internet Explorer
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply updates per vendor instructions.
Internet Explorer versions 9 through 11 have a flaw that allows attackers to run malicious code or crash the browser by visiting a specially crafted website. This happens because the browser doesn't properly manage memory when processing certain web content.
A remote attacker can exploit a memory corruption vulnerability in Internet Explorer 9-11 through a crafted web page without requiring user interaction beyond visiting the malicious site. The vulnerability stems from improper memory handling (CWE-787: out-of-bounds write) and can result in arbitrary code execution or denial of service depending on browser architecture and mitigation bypass conditions.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.