CVE-2017-11874: Low severity chakracore vulnerability

Published Nov 15, 2017

Updated

Microsoft Edge in Microsoft Windows 10 1703, 1709, Windows Server, version 1709, and ChakraCore allows an attacker to bypass Control Flow Guard (CFG) to run arbitrary code on a target system, due to how Microsoft Edge handles accessing memory in code compiled by the Edge Just-In-Time (JIT) compiler, aka "Microsoft Edge Security Feature Bypass Vulnerability". This CVE ID is unique from CVE-2017-11863 and CVE-2017-11872.

Affected Software

5 affected components

Microsoft ChakraCore

Microsoft Edge

Microsoft Windows 10=1703

Microsoft Windows 10=1709

Microsoft Windows Server=1709

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11874

Event History

Nov 15, 2017

CVE Published

via MITRE·03:00 AM

Data Sourced

via MITRE·03:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2017-11874?

CVE-2017-11874 has a critical severity rating due to its potential to allow arbitrary code execution.

How do I fix CVE-2017-11874?

To fix CVE-2017-11874, ensure that Microsoft Edge and ChakraCore are updated to the latest versions provided by Microsoft.

What systems are affected by CVE-2017-11874?

CVE-2017-11874 affects Microsoft Edge on Windows 10 versions 1703 and 1709, as well as ChakraCore.

Can CVE-2017-11874 be exploited remotely?

Yes, CVE-2017-11874 can be exploited remotely, allowing attackers to execute arbitrary code without physical access to the target system.

Is there a workaround for CVE-2017-11874?

Currently, the best approach for mitigating CVE-2017-11874 is to apply the recommended updates from Microsoft.