CVE-2015-1684

medium
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

VBScript.dll in the Microsoft VBScript 5.6 through 5.8 engine, as used in Internet Explorer 8 through 11 and other products, allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript ASLR Bypass."

References

http://www.securityfocus.com/bid/74522

http://www.securitytracker.com/id/1032282

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-043

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-053

Details

Source: MITRE

Published: 2015-05-13

Updated: 2018-10-12

Type: CWE-200

Risk Information

CVSS v2

Base Score: 4.3

Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N

Impact Score: 2.9

Exploitability Score: 8.6

Severity: MEDIUM

Tenable Plugins

View all (2 total)

IDNameProductFamilySeverity
83364MS15-053: Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass (3057263)NessusWindows : Microsoft Bulletins
medium
83358MS15-043: Cumulative Security Update for Internet Explorer (3049563)NessusWindows : Microsoft Bulletins
high