CVE-2018-0767: Medium severity Microsoft ChakraCore vulnerability

Q: What is the severity of CVE-2018-0767?

CVE-2018-0767 is rated as important because it allows an attacker to obtain sensitive information from the system.

Q: How do I fix CVE-2018-0767?

To fix CVE-2018-0767, users should update their Microsoft Edge and Windows operating systems to the latest versions provided by Microsoft.

Q: What systems are affected by CVE-2018-0767?

CVE-2018-0767 affects Microsoft Edge in Windows 10 versions 1511, 1607, 1703, 1709, and Windows Server 2016.

Q: What is the potential impact of CVE-2018-0767?

The potential impact of CVE-2018-0767 is information disclosure, which can be exploited to further compromise the user’s system.

Q: Is CVE-2018-0767 a zero-day vulnerability?

CVE-2018-0767 was disclosed and addressed in security updates, thus it is no longer a zero-day vulnerability.

Published Jan 4, 2018

Updated

Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to obtain information to further compromise the user's system, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0780 and CVE-2018-0800.

Affected Software

7 affected components

Microsoft ChakraCore<1.7.6

Microsoft Edge

Microsoft Windows 10=1511

Microsoft Windows 10=1607

Microsoft Windows 10=1703

Microsoft Windows 10=1709

Microsoft Windows Server 2016

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0767

Event History

Jan 4, 2018

CVE Published

via MITRE·02:00 PM

Data Sourced

via MITRE·02:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2018-0767?

CVE-2018-0767 is rated as important because it allows an attacker to obtain sensitive information from the system.

How do I fix CVE-2018-0767?