Patchfirst
Patchfirst
CVE-2019-0911 EPSS 9.1%

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft…

Microsoft · Internet Explorer 11

Summary

A memory corruption flaw in the scripting engine of Microsoft Internet Explorer 11 allows remote code execution through how the engine handles objects in memory. The attack vector, privileges, user interaction and configuration requirements are not specified in the available information.

Official description · CVE.org

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0884, CVE-2019-0918.

Breakdown
19.1 / 100
Exploited
Not confirmed
Reports
0
Tactics
4/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

Disclosed on 16 May 2019. No public exploit code or confirmed exploitation is recorded.

techniques

4 , grouped by in kill-chain order 4

Initial AccessTA0001

Drive-by Compromise T1189
MITRE CTID mapping of the CVE · how it is exploited

ExecutionTA0002

Malicious File T1204.002
MITRE CTID mapping of the CVE · how it is exploited
Hijack Execution Flow T1574 also Stealth
MITRE CTID mapping of the CVE · primary impact

ImpactTA0040

Application or System Exploitation T1499.004
MITRE CTID mapping of the CVE · primary impact

Detection

0 rules for this CVE · 53 general rules for its techniques

Rules for this CVE

0 that reference CVE-2019-0911 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Drive-by CompromiseT11893 general rules
Malicious FileT1204.00239 general rules
All 39 on SigmaHQ ↗
Hijack Execution FlowT15748 general rules
Application or System ExploitationT1499.0043 general rules

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.

NuGetMicrosoft.ChakraCoreGHSA-9735-p6r2-2hgh

Upgrade to 1.11.11 or later

Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).

Set the version to 1.11.11 or later in your .csproj.

First fixed in 1.11.9 for CVE-2019-0911.

Affected versions

If you runUpgrade to
All versions before 1.11.91.11.11first fix for this CVE: 1.11.9

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

1 link, grouped by NVD tag

x_refsource_MISC 1

portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0911
↑ ↓ chooseEnter openEsc close