Microsoft Internet Explorer 11 and Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2447.

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3082442. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website.

Note that the majority of the vulnerabilities addressed by Cumulative Security Update 3082442 are mitigated by the Enhanced Security Configuration (ESC) mode which is enabled by default on Windows Server 2003, 2008, 2008 R2, 2012, and 2012 R2.

The version of Microsoft Edge installed on the remote host is missing Cumulative Security Update 3081436. It is, therefore, affected by multiple vulnerabilities :

  - Multiple memory corruption issues exist due to improper     access to objects in memory resulting from insufficient     validation of user-supplied input. A remote attacker,     using a specially crafted website, can exploit these     issues to execute arbitrary code in the context of the     current user. (CVE-2015-2441, CVE-2015-2442,     CVE-2015-2446)

  - A security feature bypass vulnerability exists due to     a failure to use Address Space Layout Randomization     (ASLR). An attacker can exploit this to predict memory     offsets in a call stack. (CVE-2015-2449)

ID	Name	Product	Family	Severity
85333	MS15-079: Cumulative Security Update for Internet Explorer (3082442)	Nessus	Windows : Microsoft Bulletins	high
85324	MS15-091: Cumulative Security Update for Microsoft Edge (3084525)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2015-2446

high

Tenable Plugins

high

high