Microsoft Edge Information Disclosure Vulnerability
CVE-2017-8662 is fixed in 2 products on 1 platform, first by KB4034674, released August 8, 2017. It is not reported as exploited, but the vendor rates exploitation more likely. Patch Radar priority: Urgent.
<p>An information disclosure vulnerability for Microsoft Edge exists as a result of how strings are validated in specific scenarios, which can allow an attacker to read sensitive data from memory and thereby potentially bypass <a href="https://technet.microsoft.com/en-us/library/security/dn848375.aspx#ASLR">Address Space Layout Randomization (ASLR)</a>. By itself, this vulnerability does not allow arbitrary code execution. However, an attacker could use this vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, to run arbitrary code on a target system.</p> <p>Successful exploitation of the vulnerability requires a user to be logged on and running an affected version of Microsoft Edge. The user would then need to browse to a malicious site.</p> <p>The security update addresses the vulnerability by helping to ensure that Microsoft Edge properly validates strings in affected scenarios.</p>