Microsoft fixes zero-day vulnerability in Internet Explorer

Microsoft released its Patch Tuesday February 2020 yesterday , which fixes a total of 99 vulnerabilities . However, the most significant issue being fixed is a zero-day vulnerability that allows remote code execution and affects multiple versions of Internet Explorer .

The vulnerability was disclosed by Microsoft itself in mid-January 2020. The company had released a security advisory to warn users about a zero-day vulnerability in Internet Explorer ( CVE-2020-0674 ), which was already being exploited by hackers .

The zero-day vulnerability was discovered and reported by Clément Lecigne from Google 's threat analysis team and Ella Yu from Qihoo 360. According to the experts: the vulnerability "could corrupt memory in such a way that an attacker could execute code when the user is using the vulnerable system ."

If the user is logged in with administrator privileges on a vulnerable device, attackers can gain full control of the system and therefore can install programs and manipulate data.

Mitigation

Until yesterday, when updates , there had been no fix for the zero-day vulnerability in Internet Explorer. Microsoft had only released some mitigations, which removed the permission for jscript.dll, so that attackers could not exploit the vulnerability. However, there were some limitations.

With the February Patch, Microsoft has released official security updates for the CVE-2020-0674 | Scripting Engine Memory Corruption vulnerability. With these updates, users can fully protect their systems.

All Internet Explorer users are urged to immediately update vulnerable systems, because this particular zero-day vulnerability is very dangerous.

In the table below, you can find links to the pages that detail the changes as well as the Microsoft Update catalog for each security update.