Actively exploited · Published Mar 17, 2017 · Assigned by microsoft

CVE-2017-0059

Medium 4.3 Exploited

In plain English

A medium-severity security flaw in Internet Explorer from Microsoft Corporation. Attackers are actively exploiting it in the wild (listed by CISA on March 28, 2022). The chance it is exploited in the next 30 days is estimated at 62.0% (higher than 99.2% of all known vulnerabilities). Apply updates per vendor instructions.

Severity (CVSS 3.1)4.3Medium

Exploit odds (30 days)62.0%top 0.8% of all CVEs

Exploited in the wildYesCISA KEV since Mar 28, 2022

Attack toolingNoneno public tooling known

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Apr 18, 2022.

Official description

Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0008 and CVE-2017-0009.

Affected products (as reported)

Vendor	Product	Versions
Microsoft Corporation	Internet Explorer	Internet Explorer 9 through 11

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0059 x_refsource_CONFIRM
96645 vdb-entry, x_refsource_BID
43125 exploit, x_refsource_EXPLOIT-DB
41661 exploit, x_refsource_EXPLOIT-DB
42354 exploit, x_refsource_EXPLOIT-DB
1038008 vdb-entry, x_refsource_SECTRACK
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-0059 government-resource