Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2015-6068, CVE-2015-6072, CVE-2015-6075, CVE-2015-6077, CVE-2015-6079, CVE-2015-6080, and CVE-2015-6082.

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3104519. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist due     to improper handling of objects in memory. A remote     attacker can exploit these vulnerabilities, via a     specially crafted website, to execute arbitrary code in     the context of the current user. (CVE-2015-6064,     CVE-2015-6073, CVE-2015-6078)

  - A security feature bypass vulnerability exists due to     a failure to use Address Space Layout Randomization     (ASLR). An attacker can exploit this to predict memory     offsets in a call stack. (CVE-2015-6088)

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3104517. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
86820	MS15-113: Cumulative Security Update for Microsoft Edge (3104519)	Nessus	Windows : Microsoft Bulletins	high
86819	MS15-112: Cumulative Security Update for Internet Explorer (3104517)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2015-6073

high

Tenable Plugins

high

high