SB2016110901 - Multiple vulnerabilities in Microsoft Edge
Published: November 9, 2016
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 16 secuirty vulnerabilities.
1) Information Disclosure (CVE-ID: CVE-2016-7227)
A remote attacker can obtain potentially sensitive information.
The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and detect specific files on the user's computer.
Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information.
2) Spoofing attack (CVE-ID: CVE-2016-7209)
A remote attacker can perform a spoofing attack.
The vulnerability exists due to an error when parsing HTTP responses. A remote attacker can redirect a victim to a specially crafted web site and perform spoofing attack.
Successful exploitation of the vulnerability may allow an attacker to spoof website content.
Note: this vulnerability is publicly disclosed.
3) Information Disclosure (CVE-ID: CVE-2016-7204)
A remote attacker can obtain potentially sensitive information.
The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and gain access to the user’s My Documents folder
Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information.
4) Scripting engine memory corruption (CVE-ID: CVE-2016-7243)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory within Microsoft scripting engines render. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
5) Scripting engine memory corruption (CVE-ID: CVE-2016-7242)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory within Microsoft scripting engines render. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
6) Scripting engine memory corruption (CVE-ID: CVE-2016-7240)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory within Microsoft scripting engines render. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
7) Scripting engine memory corruption (CVE-ID: CVE-2016-7208)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory within Microsoft scripting engines render. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
8) Scripting engine memory corruption (CVE-ID: CVE-2016-7203)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory within Microsoft scripting engines render. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
9) Heap-based buffer overflow (CVE-ID: CVE-2016-7202)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of JavaScript Array.reverse method in chakra.dll. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser, cause heap-based buffer overflow and execute arbitrary code on the target system.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
10) Scripting engine memory corruption (CVE-ID: CVE-2016-7201)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory within Microsoft scripting engines render. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
11) Scripting engine memory corruption (CVE-ID: CVE-2016-7200)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory within Microsoft scripting engines render. A remote attacker can create a specially crafted web page or Microsoft Office file with embedded malicious ActiveX component, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
12) Information Disclosure (CVE-ID: CVE-2016-7199)
A remote attacker can obtain potentially sensitive information.
The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and obtain browser window state from a different domain.
Successful exploitation of the vulnerability may allow an attacker to gain access to potentially sensitive information.
Note: this vulnerability was publicly disclosed.
13) Memory Corruption (CVE-ID: CVE-2016-7241)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
14) Memory Corruption (CVE-ID: CVE-2016-7198)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
15) Memory Corruption (CVE-ID: CVE-2016-7196)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
16) Memory Corruption (CVE-ID: CVE-2016-7195)
A remote attacker can execute arbitrary code on the target system.
The vulnerability exists due to incorrect handling of objects in memory. A remote attacker can create a specially crafted web page, trick the victim to open it in browser and cause memory corruption.
Successful exploitation of the vulnerability may allow an attacker to execute arbitrary code on vulnerable system with privileges of the current user.
Remediation
Install update from vendor's website.