#VU5240 Privilege escalation in Microsoft Internet Explorer and Microsoft Edge - CVE-2016-3292
Published: September 13, 2016 / Updated: February 14, 2017
Vulnerability identifier: #VU5240
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2016-3292
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Microsoft Internet Explorer
Microsoft Edge
Microsoft Internet Explorer
Microsoft Edge
Software vendor:
Microsoft
Microsoft
Description
The vulnerability allows a remote attacker to gain elevated privileges on the target system.
The vulnerability exists due to improper checking of zone and integrity settings. A remote attacker can create a specially crafted content, trick the victim into opening it, escape the sandbox and gain elevated privileges.
Successful exploitation of this vulnerability results in information disclosure on the vulnerable system.
Remediation
Install update from vendor's website.