Multiple vulnerabilities in Microsoft Internet Explorer
| Risk | Critical |
| Patch available | YES |
| Number of vulnerabilities | 5 |
| CVE-ID | CVE-2016-0194 CVE-2016-0192 CVE-2016-0189 CVE-2016-0188 CVE-2016-0187 |
| CWE-ID | CWE-388 CWE-119 CWE-284 |
| Exploitation vector | Network |
| Public exploit | Vulnerability #3 is being exploited in the wild. |
| Vulnerable software Subscribe |
Microsoft Internet Explorer Client/Desktop applications / Web browsers Microsoft Edge Client/Desktop applications / Web browsers Microsoft JScript Universal components / Libraries / Scripting languages VBScript Universal components / Libraries / Scripting languages |
| Vendor | Microsoft |
Security Bulletin
This security bulletin contains information about 5 vulnerabilities.
1) Information disclosure
EUVDB-ID: #VU5080
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-0194
CWE-ID:
CWE-388 - Error Handling
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to obtain potentially sensitive information on the target system.
The weakness exists due to improper handling of files. A remote attacker can create a specially crafted content, trick the victim into opening it, view the contents of arbitrary files on the system and use this information to launch further attacks.
Successful exploitation of the vulnerability results in information disclosure on the vulnerable system.
Install update form vendor's website.
Microsoft Internet Explorer: 10 - 11
External linkshttp://technet.microsoft.com/en-us/library/security/ms16-051.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
2) Memory corruption
EUVDB-ID: #VU5079
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-0192
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Install update from vendor's website.
Vulnerable software versionsMicrosoft Internet Explorer: 9 - 11
Microsoft Edge: All versions
External linkshttp://technet.microsoft.com/en-us/library/security/ms16-051.aspx
http://technet.microsoft.com/en-us/library/security/ms16-052.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
3) Memory corruption
EUVDB-ID: #VU5077
Risk: Critical
CVSSv3.1: 9.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C]
CVE-ID: CVE-2016-0189
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: Yes
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Note: the vulnerability was being actively exploited.
Install update from vendor's website.
Vulnerable software versionsMicrosoft JScript: 5.8
Microsoft Internet Explorer: 9 - 11
VBScript: 5.8
External linkshttp://technet.microsoft.com/en-us/library/security/ms16-051.aspx
http://technet.microsoft.com/en-us/library/security/ms16-053.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
Yes. This vulnerability is being exploited in the wild.
4) Security bypass
EUVDB-ID: #VU5078
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-0188
CWE-ID:
CWE-284 - Improper Access Control
Exploit availability: No
DescriptionThe vulnerabiity allows a remote attacker to bypass security restrictions on the target system.
The weakness exists due to improper validation of code integrity by the User Mode Code Integrity (UMCI) component of Device Guard. A remote attacker can create a specially crafted Web site, trick the victim into visiting it, bypass code-signing protection mechanism and execute a malicious code.
Successful exploitation of this vulnerability may result in arbitrary code execution on the vulnerable system.
Install update from vendor's website.
Microsoft Internet Explorer: 11
External linkshttp://technet.microsoft.com/en-us/library/security/ms16-051.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
5) Memory corruption
EUVDB-ID: #VU5076
Risk: High
CVSSv3.1: 8.3 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID: CVE-2016-0187
CWE-ID:
CWE-119 - Memory corruption
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to execute arbitrary code on the target system.
The weakness exists due to boundary error in the Scripting Engine when handling malicious files. A remote attacker can create a specially crafted content, trick the victim into opening it, trigger memory corruption and execute arbitrary code.
Successful exploitation of the vulnerability results in arbitrary code execution on the vulnerable system.
Install update from vendor's website.
Vulnerable software versionsMicrosoft Internet Explorer: 9 - 11
External linkshttp://technet.microsoft.com/en-us/library/security/ms16-051.aspx
http://technet.microsoft.com/en-us/library/security/ms16-053.aspx
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
How the attacker can exploit this vulnerability?
The attacker would have to trick the victim to visit a specially crafted website.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
