Newsletter Archives

  • Heads up — Bug fix for IE coming out through Win10 cumulative updates, Win7 and 8.1

    Microsoft just posted CVE-2018-8653: Scripting Engine Memory Corruption Vulnerability

    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

    Looks like a drive-by: You can get infected by simply viewing a bad site, but only if you’re using Internet Explorer.

    Which, of course, you aren’t.

    The patches:

    Win10 1809KB 4483235 – build 17763.195

    Win10 1803KB 4483234 – build 17134.472

    Win10 1709KB 4483232 – build 16299.847

    IE 11 on Win7 and 8.1 – KB 4483187

    Way-out-of-band patches like this one have a nasty history of blowing up. I strongly suggest you avoid the patch – and avoid Internet Explorer. But you’ve heard me say that a few times already, eh?