Description
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Microsoft | Internet Browser | Internet Explorer 10 and 11 and Edge | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 3
- Microsoft Internet Explorer 11 (Windows 7 x86) - 'mshtml.dll' Remote Code Execution (MS17-007) EDB-43125 · remote · Oct 17, 2017 · verified
- Microsoft Internet Explorer - 'mshtml.dll' Remote Code Execution (MS17-007) EDB-42354 · remote · Jul 24, 2017
- Microsoft Edge / Internet Explorer - 'HandleColumnBreakOnColumnSpanningElement' Type Confusion EDB-41454 · dos · Feb 24, 2017 · verified
GitHub 1 repository
-
chattopadhyaykittu/CVE-2017-0037 ★ 0 · Mar 28, 2022
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://bugs.chromium.org/p/project-zero/issues/detail?id=1011
- https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html
- 96088 vdb-entry
- 41454 exploit
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0037
- 43125 exploit
- 1037905 vdb-entry
- 42354 exploit
- 1037906 vdb-entry