KLA10755 Multiple vulnerabilities in Microsoft Edge

Multiple serious vulnerabilities have been found in Microsoft Edge. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code or bypass security features.

Below is a complete list of vulnerabilities

1. An improper HTTP responses parsing can be exploited remotely via a specially designed web site to spoof user interface;
2. An improper exceptions handling can be exploited remotely via a specially designed web site to bypass Address Space Layout Randomization;
3. An improper memory objects access can be exploited remotely via a specially designed web site to execute arbitrary code.

Original advisories

CVE-2016-0060

CVE-2016-0061

CVE-2016-0062

CVE-2016-0084

CVE-2016-0080

CVE-2016-0077

Related products

Microsoft-Edge

CVE list

CVE-2016-0060 critical

CVE-2016-0061 critical

CVE-2016-0062 critical

CVE-2016-0084 critical

CVE-2016-0080 warning

CVE-2016-0077 warning

KB list

3135173

3135174

3134225

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Edge