SB2016121310 - Multiple vulnerabilities in Microsoft Internet Explorer and Microsoft Edge

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Memory corruption (CVE-ID: CVE-2016-7287)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

2) Cross-site scripting (CVE-ID: CVE-2016-7282)

Vulnerability allows a remote authenticated attacker to perform Cross-site scripting attacks.

An input validation error exists in the way Microsoft browsers handle certain untrusted input. A remote attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

3) Security restrictions bypass (CVE-ID: CVE-2016-7281)

The vulnerability allows a remote attacker to bypass certain security restrictions.

The vulnerability exists due to Microsoft browsers fail to correctly apply Same Origin Policy for scripts running inside Web Workers. A remote attacker can create a specially crafted web page, trick the victim into visiting it and bypass implied Same Origin Policy.

Successful exploitation of the vulnerability may allow an attacker to obtain potentially sensitive information and perform other attacks against victim.

4) Memory corruption (CVE-ID: CVE-2016-7279)

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error. A remote attacker can create a specially crafted web page, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Remediation

Install update from vendor's website.

References

• https://technet.microsoft.com/en-us/library/security/ms16-145.aspx
• https://technet.microsoft.com/en-us/library/security/ms16-144.aspx