SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


Try our Premium Alert Service
 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service





Category:   Application (Web Browser)  >   Microsoft Internet Explorer Vendors:   Microsoft
Microsoft Internet Explorer Multiple Bugs Let Remote Users Bypass ASLR and Execute Arbitrary Code
SecurityTracker Alert ID:  1032282
SecurityTracker URL:  http://securitytracker.com/id/1032282
CVE Reference:   CVE-2015-1658, CVE-2015-1684, CVE-2015-1685, CVE-2015-1686, CVE-2015-1688, CVE-2015-1689, CVE-2015-1691, CVE-2015-1692, CVE-2015-1694, CVE-2015-1703, CVE-2015-1704, CVE-2015-1705, CVE-2015-1706, CVE-2015-1708, CVE-2015-1709, CVE-2015-1710, CVE-2015-1711, CVE-2015-1712, CVE-2015-1713, CVE-2015-1714, CVE-2015-1717, CVE-2015-1718   (Links to External Site)
Date:  May 12 2015
Impact:   Disclosure of system information, Execution of arbitrary code via network, User access via network
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): 6, 7, 8, 9, 10, 11
Description:   Multiple vulnerabilities were reported in Microsoft Internet Explorer. A remote user can cause arbitrary code to be executed on the target user's system. A remote authenticated user can gain elevated privileges on the target system. A remote user can bypass security protections on the target system.

A remote user can create specially crafted HTML that, when loaded by the target user, will trigger a memory corruption error and execute arbitrary code on the target system [CVE-2015-1658, CVE-2015-1684, CVE-2015-1685, CVE-2015-1686, CVE-2015-1688, CVE-2015-1689, CVE-2015-1691, CVE-2015-1692, CVE-2015-1694, CVE-2015-1703, CVE-2015-1704, CVE-2015-1705, CVE-2015-1706, CVE-2015-1708, CVE-2015-1709, CVE-2015-1710, CVE-2015-1711, CVE-2015-1712, CVE-2015-1713, CVE-2015-1714, CVE-2015-1717, CVE-2015-1718]. The code will run with the privileges of the target user.

A remote authenticated user that can exploit a separate vulnerability can gain elevated privileges on the target system [CVE-2015-1688, CVE-2015-1703, CVE-2015-1704, CVE-2015-1713].

A remote user can bypass address space layout randomization (ASLR) protections [CVE-2015-1684, CVE-2015-1685, CVE-2015-1686].


Impact:   A remote user can create HTML that, when loaded by the target user, will execute arbitrary code on the target user's system.

A remote authenticated user can gain elevated privileges on the target system.

A remote user can bypass address space layout randomization (ASLR) protections.

Solution:   The vendor has issued a fix.

A patch matrix is available in the vendor's advisory.

The Microsoft advisory is available at:

https://technet.microsoft.com/library/security/ms15-043

Vendor URL:  technet.microsoft.com/library/security/ms15-043 (Links to External Site)
Cause:   Access control error
Underlying OS:  Windows (Any)

Message History:   This archive entry has one or more follow-up message(s) listed below.
May 12 2015 (Microsoft Issues Fix for Windows JScript/VBScript Scripting Engine) Microsoft Internet Explorer Multiple Bugs Let Remote Users Bypass ASLR and Execute Arbitrary Code
Microsoft has issued a fix for Windows JScript/VBScript Script Engine.



 Source Message Contents



[Original Message Not Available for Viewing]


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2018, SecurityGlobal.net LLC