CVE-2017-0037 Microsoft Edge and Internet Explorer Type Confusion
Remote attackers can execute arbitrary code in Internet Explorer and Edge via crafted CSS and JavaScript exploiting a type confusion vulnerability.
- Exploited in the wild
- Since 28 Mar 2022
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-0037?
CVE-2017-0037 is a high-severity memory corruption vulnerability in Microsoft Edge, published on 26 Feb 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.
Weakness: CWE-843
Which versions are affected by CVE-2017-0037?
It affects 2 products.
Products include Microsoft Edge, Microsoft Internet Explorer.
How do I fix CVE-2017-0037?
No fix has been published for CVE-2017-0037 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 18 Apr 2022.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2017-0037 being exploited?
Yes. Attackers have exploited CVE-2017-0037 in the wild since at least 28 Mar 2022.
Public exploit code: 3 Exploit-DB entries and 1 proofs of concept on GitHub.
Other vulnerabilities in Microsoft Edge
Sources
Also known as GHSA-xpg5-jv85-754h.