OnlyPatch
Microsoft Windows

CVE-2018-0847 — Windows Scripting Engine Memory Corruption Vulnerability

Important CVSS 4.3 2018-02 archive

Executive Summary

An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user’s computer or data. To exploit the vulnerability, an attacker must know the memory address of where the object was created. The update addresses the vulnerability by changing the way certain functions handle objects in memory.

Overview

4.3
CVSS MEDIUM
Important
MS Severity
Not Exploited
MS Exploit Status
More Likely
MS Exploit Likelihood
Category Information Disclosure
Released Feb 13 2018
Last Updated Feb 13 2018
Publicly Disclosed No
CISA KEV Not Listed
Known Exploits None Known

CVSS Vector

ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
Required
SCOPE
Unchanged
CONFIDENTIALITY
Low
INTEGRITY
None
AVAILABILITY
None
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 3.9

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

21 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 4074596 (Security Update) Important Information Disclosure Yes
Windows 10 for x64-based Systems 4074596 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1511 for 32-bit Systems 4074591 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1511 for x64-based Systems 4074591 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1607 for 32-bit Systems 4074590 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1607 for x64-based Systems 4074590 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1703 for 32-bit Systems 4074592 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1703 for x64-based Systems 4074592 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1709 for 32-bit Systems 4074588 (Security Update) Important Information Disclosure Yes
Windows 10 Version 1709 for x64-based Systems 4074588 (Security Update) Important Information Disclosure Yes
Windows 7 for 32-bit Systems Service Pack 1 4074598 (Monthly Rollup) 4074587 (Security Only) Important Information Disclosure 4056894 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows 7 for x64-based Systems Service Pack 1 4074598 (Monthly Rollup) 4074587 (Security Only) Important Information Disclosure 4056894 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows 8.1 for 32-bit systems 4074594 (Monthly Rollup) 4074597 (Security Only) Important Information Disclosure 4056895 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows 8.1 for x64-based systems 4074594 (Monthly Rollup) 4074597 (Security Only) Important Information Disclosure 4056895 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows RT 8.1 4074594 (Monthly Rollup) Important Information Disclosure Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 4034044 (Security Update) Important Information Disclosure Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 4034044 (Security Update) Important Information Disclosure Yes
Windows Server 2008 for Itanium-Based Systems Service Pack 2 4034044 (Security Update) Important Information Disclosure Yes
Windows Server 2008 for x64-based Systems Service Pack 2 4034044 (Security Update) Important Information Disclosure Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 4034044 (Security Update) Important Information Disclosure Yes
Windows Server 2008 R2 for Itanium-Based Systems Service Pack 1 4074598 (Monthly Rollup) Important Information Disclosure Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 4074598 (Monthly Rollup) Important Information Disclosure Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 4074598 (Monthly Rollup) Important Information Disclosure Yes
Windows Server 2012 4074593 (Monthly Rollup) 4074589 (Security Only) Important Information Disclosure 4056896 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows Server 2012 (Server Core installation) 4074593 (Monthly Rollup) 4074589 (Security Only) Important Information Disclosure 4056896 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows Server 2012 R2 4074594 (Monthly Rollup) 4074597 (Security Only) Important Information Disclosure 4056895 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows Server 2012 R2 (Server Core installation) 4074594 (Monthly Rollup) 4074597 (Security Only) Important Information Disclosure 4056895 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C Yes None Windows Server 2016 4074590 (Security Update) Important Information Disclosure Yes
Windows Server 2016 (Server Core installation) 4074590 (Security Update) Important Information Disclosure Yes

Patches

8 patches
Article Type Restart
4074596 Security Update Yes
4074591 Security Update Yes
4074590 Security Update Yes
4074592 Security Update Yes
4074588 Security Update Yes
4074594 Monthly Rollup Yes
4034044 Security Update Yes
4074598 Monthly Rollup Yes

Known Exploits

Acknowledgments

None

On This Page