Memory corruption in JScript and VBScript in Microsoft products - CVE-2016-3204

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to an error in JScript and VBScript engines render when handling objects in memory in Internet Explorer. A remote attacker can trick a victim to visit malicious webpage and execute arbitrary code on the target system with privileges of the current user.

Successful exploitation of this vulnerability will allow an attacker to gain control over affected system.

Affected software

How to mitigate CVE-2016-3204

To resolve this vulnerability vendor recommends installing the following updates:

Windows Vista

Windows Vista Service Pack 2
Windows Vista x64 Edition Service Pack 2

Windows Server 2008

Windows Server 2008 for x32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for Itanium-based Systems Service Pack 2

Server Core installation option

Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 R2 for x64-based Systems Service Pack 1

External References

• https://technet.microsoft.com/en-us/library/security/MS16-086
• https://technet.microsoft.com/en-us/library/security/ms16-084.aspx

Related Security Bulletins

• Remote code execution in JScript and VBScript in Microsoft Windows
• Scripting Engine Memory Corruption Vulnerability
• Cumulative Security Update for JScript and VBScript