cve/2017/CVE-2017-0037.md

CVE-2017-0037

Description

Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakOnColumnSpanningElement function in mshtml.dll, which allows remote attackers to execute arbitrary code via vectors involving a crafted Cascading Style Sheets (CSS) token sequence and crafted JavaScript code that operates on a TH element.

POC

Reference

• https://0patch.blogspot.si/2017/03/0patching-another-0-day-internet.html
• https://www.exploit-db.com/exploits/41454/
• https://www.exploit-db.com/exploits/42354/
• https://www.exploit-db.com/exploits/43125/

Github

• https://github.com/ARPSyndicate/cvemon
• https://github.com/LyleMi/dom-vuln-db
• https://github.com/Ostorlab/KEV
• https://github.com/Ostorlab/known_exploited_vulnerbilities_detectors
• https://github.com/chattopadhyaykittu/CVE-2017-0037
• https://github.com/googleprojectzero/domato
• https://github.com/hwiwonl/dayone
• https://github.com/lnick2023/nicenice
• https://github.com/marckwei/temp
• https://github.com/merlinepedra/DONATO
• https://github.com/merlinepedra25/DONATO
• https://github.com/qazbnm456/awesome-cve-poc
• https://github.com/redr2e/exploits
• https://github.com/xbl3/awesome-cve-poc_qazbnm456
• https://github.com/xinali/articles