Actively exploited · Published Mar 6, 2019 · Assigned by microsoft
CVE-2019-0676
Medium 6.5 Exploited
In plain English
A medium-severity security flaw in Internet Explorer 10 from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on May 23, 2022). The chance it is exploited in the next 30 days is estimated at 8.1% (higher than 95% of all known vulnerabilities). Apply updates per vendor instructions.
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 13, 2022.
Official description
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Internet Explorer 11 | Windows 7 for 32-bit Systems Service Pack 1Windows 7 for x64-based Systems Service Pack 1Windows Server 2008 R2 for x64-based Systems Service Pack 1Windows 8.1 for 32-bit systemsWindows 8.1 for x64-based systemsWindows Server 2012 R2Windows RT 8.1Windows 10 for 32-bit Systems |
| Microsoft | Internet Explorer 10 | Windows Server 2012 |
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676 x_refsource_CONFIRM
- 106886 vdb-entry, x_refsource_BID
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0676 government-resource