Microsoft Internet Explorer脚本引擎信息泄露漏洞

受影响系统：
Microsoft Internet Explorer 11
Microsoft Internet Explorer 11
Microsoft Internet Explorer 10
Microsoft Windows Server 2016
Microsoft Windows Server 2016
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2012 R2
Microsoft Windows Server 2012
Microsoft Windows Server 2008 R2 for x64-based Systems
Microsoft Windows Server 2008 R2 for x64-based Systems
Microsoft Windows Server 2008 R2 for x64-based Systems
Microsoft Windows Server 2008 for Itanium-based Systems
Microsoft Windows Server 2008 for Itanium-based Systems
Microsoft Windows 7 Windows 7 for 32-bit Systems S
Microsoft Windows 7 Windows 7 for 32-bit Systems S
Microsoft Windows 7 Microsoft Windows 7 for x64-ba
Microsoft Windows 7 Microsoft Windows 7 for x64-ba
Microsoft Windows 10 Version 1803 for x64-based Sys
Microsoft Windows 10 Version 1803 for 32-bit System
Microsoft Windows 10 Version 1709 for ARM64-based S
Microsoft Windows 10 Version 1709 for 32-bit System
Microsoft Windows 10 Version 1703 for x64-based Sys
Microsoft Windows 10 Version 1703 for 32-bit System
Microsoft Windows 10 version 1607 for x64-based Sys
Microsoft Windows 10 version 1607 for 32-bit System
Microsoft Windows 10 version 1511 for x64-based Sys
Microsoft Windows 10 version 1511 for 32-bit System
Microsoft Windows 10 for x64-based Systems
Microsoft Windows 10 for 32-bit Systems
Microsoft Windows RT 8.1
Microsoft Windows RT 8.1
Microsoft Windows 8.1 for x64-based Systems
Microsoft Windows 8.1 for 32-bit Systems
Microsoft Windows 8 for x64-based Systems
Microsoft Windows 8 for 32-bit Systems
描述：
--------------------------------------------------------------------------------
BUGTRAQ ID: 107721
CVE(CAN) ID: CVE-2019-0835

Microsoft Edge是一个由微软研发的浏览器。
当脚本引擎无法正确处理内存中的对象时，存在信息泄露漏洞。成功利用此漏洞的攻击者可以获取信息以进一步危害用户的系统。

在基于Web的攻击情形中，攻击者可以托管网站以尝试利用此漏洞。此外，受到破坏的网站和接受或托管用户提供的内容的网站可能包含可能利用此漏洞的特制内容。但是，在所有情况下，攻击者都无法强迫用户查看攻击者控制的内容。相反，攻击者必须说服用户采取行动。例如，攻击者可以欺骗用户点击将用户带到攻击者网站的链接。

<*链接：https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0835
*>

建议：
--------------------------------------------------------------------------------
厂商补丁：

Microsoft
---------
Microsoft已经为此发布了一个安全公告（CVE-2019-0835）以及相应补丁:
CVE-2019-0835：Microsoft Scripting Engine Information Disclosure Vulnerability
链接：https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0835

补丁下载：

原作者：不详
来 源：不详
共有305位读者阅读过此文