The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Scripting Engine Information Disclosure Vulnerability."

The remote Windows host is missing a security update. It is, therefore, affected by multiple vulnerabilities :

  - An information disclosure vulnerability exists in     VBScript due to the improper disclosure of memory     contents. An attacker can exploit this to gain     information that can be used to further compromise a     user's computer or data. (CVE-2015-6135)

  - A remote code execution vulnerability exists related to     the way the VBScript engine renders when handling     objects in memory in Internet Explorer. A remote     attacker can exploit this, via a crafted web page,     document, or application, to gain elevated privileges     and take full control of an affected system.
    (CVE-2015-6136)

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3116180. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Type	Severity
87255	MS15-126: Cumulative Security Update for JScript and VBScript to Address Remote Code Execution (3116178)	Nessus	Windows : Microsoft Bulletins	Local	high
87253	MS15-124: Cumulative Security Update for Internet Explorer (3116180)	Nessus	Windows : Microsoft Bulletins	Local	critical

Detections

Analytics

CVE-2015-6135

medium

Tenable Plugins

high

critical