# MA-758.112019: MyCERT Alert - Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability (CVE-2019-1429)

**Date:** 21 Nov 2019  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-758.112019  
**Advisory ID:** MA-758.112019

---

**1.0 Introduction**
Recently, MyCERT received information from valid resources about exploits in Internet Explorer. Exploit known to be a remote code execution (RCE) that will corrupt memory to execute arbitrary code within the current user context. Aside from that, an attacker could also embed this exploit in Microsoft Office application that hosts the IE rendering engine.
**2.0 Impact**
The attacker will craft a malicious website and sent out to targeted users to access the website through internet explorer, allowing attacker to gain user rights that have administrative privilege. This will enable attacker to take control of affected system and allow them to modify, delete or create new user with full user rights.
**3.0 Affected System and Devices**
- Microsoft Internet Explorer below or equal version 11
**4.0 Recommendations**
As of the writing of this advisory, Microsoft has not released any security patches for this vulnerability. However, users can use the following step as a temporary workaround if they need to use Microsoft Internet Explorer:
- Avoid clicking any suspicious links until maintainers release patch to the public.
- Browse the software with least privilege user to limit the execution of the malicious file.
- Consider using alternative web browsers to browse the Internet. Please make sure you use the latest version and stay up-to-date as well.
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my
Phone: 1-300-88-2999 (monitored during business hours)
Fax: +603 - 8008 7000 (Office Hours)
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS: CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours: Mon - Fri 09:00 -18:00 MYT
Web: <https://www.mycert.org.my>
Twitter: <https://twitter.com/mycert>
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1429>