KLA10885 Multiple vulnerabilities in Microsoft Edge and Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Internet Explorer and Edge. Malicious users can exploit these vulnerabilities to execute arbitrary code, obtain sensitive information or gain privileges.

Below is a complete list of vulnerabilities

1. An improper memory objects handling can be exploited remotely via a specially designed content to execute arbitrary code;
2. An improper memory objects handling at Chakra JavaScript engine can be exploited remotely via a specially designed content to execute arbitrary code;
3. An improper memory objects handling can be exploited remotely via a specially designed content to obtain sensitive information;
4. Lack of credential data storage restrictions can be exploited locally via harvesting memory dump to obtain sensitive information;
5. Lack of private namespace security restrictions can be exploited remotely to gain privileges;
6. An improper validation can be exploited remotely via a specially designed content to bypass security restrictions.

Original advisories

CVE-2016-3331

CVE-2016-3298

CVE-2016-3267

CVE-2016-3392

CVE-2016-3391

CVE-2016-3390

CVE-2016-3389

CVE-2016-3388

CVE-2016-3387

CVE-2016-3386

CVE-2016-3385

CVE-2016-3384

CVE-2016-3383

CVE-2016-3382

Exploitation

Public exploits exist for this vulnerability.

Related products

Microsoft-Internet-Explorer

Microsoft-Edge

CVE list

CVE-2016-3331 critical

CVE-2016-3298 warning

CVE-2016-3267 warning

CVE-2016-3392 warning

CVE-2016-3391 warning

CVE-2016-3390 critical

CVE-2016-3389 critical

CVE-2016-3388 warning

CVE-2016-3387 high

CVE-2016-3386 critical

CVE-2016-3385 critical

CVE-2016-3384 critical

CVE-2016-3383 critical

CVE-2016-3382 critical

KB list

3192441

3194798

3192440

3185331

3185330

3185332

3192393

3192392

3192391

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

• ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

• OSI

Obtain sensitive information. Exploitation of vulnerabilities with this impact can lead to capturing by abuser information, critical for user or system.

• SB

Security bypass. Exploitation of vulnerabilities with this impact can lead to performing actions restricted by current security settings.

• PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

• SUI

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

• Microsoft Internet Explorer versions 9 through 11Microsoft Edge