KLA10677 Multiple vulnerabilities in Microsoft Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer. Malicious users can exploit these vulnerabilities to bypass security restrictions, gain privileges, execute arbitrary code or obtain sensitive information.

Below is a complete list of vulnerabilities

1. Improper memory objects access can be exploited remotely via a specially designed web site to execute arbitrary code;
2. Improper memory objects handling at script engines can be exploited remotely via a specially designed web site to execute arbitrary code;
3. Improper permissions validation can be exploited remotely via a specially designed web site to gain privileges;
4. Improper memory disclosure can be exploited remotely to obtaib sensitive information;
5. Lack of ASLR restrictions at script engines can be exploited remotely to obtain sensitive information;
6. Improper memory content disclosure at script engine can be exploited remotely via a specially designed web site to obtain sensitive information.

Original advisories

CVE-2015-2482

CVE-2015-6055

CVE-2015-6059

CVE-2015-6052

CVE-2015-6044

CVE-2015-6047

CVE-2015-6056

CVE-2015-6053

CVE-2015-6050

CVE-2015-6051

CVE-2015-6048

CVE-2015-6049

CVE-2015-6046

CVE-2015-6042

Exploitation

Public exploits exist for this vulnerability.

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Related products

Microsoft-Internet-Explorer

CVE list

CVE-2015-2482 critical

CVE-2015-6055 critical

CVE-2015-6059 warning

CVE-2015-6052 warning

CVE-2015-6044 high

CVE-2015-6047 high

CVE-2015-6056 critical

CVE-2015-6053 critical

CVE-2015-6050 critical

CVE-2015-6051 warning

CVE-2015-6048 critical

CVE-2015-6049 critical

CVE-2015-6046 warning

CVE-2015-6042 critical

KB list

3097617

3094995

3094996

3093983

3096441

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• RLF

Read Local Files. Exploitation of vulnerabilities with this impact can lead to reading some inaccessible files. Files that can be read depends on conсrete program errors.

Affected Products

• Microsoft Internet Explorer versions from 7 through 11