The Microsoft (1) JScript 5.8 and 9 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

The remote Windows host is missing a security update. It is, therefore, affected by a remote code execution vulnerability in the JScript and VBScript engines due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website or open a Microsoft Office document containing an embedded ActiveX control, to corrupt memory, resulting in the execution of arbitrary code in the context of the current user.

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3169991. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
92017	MS16-086: Cumulative Security Update for JScript and VBScript (3169996)	Nessus	Windows : Microsoft Bulletins	high
92015	MS16-084: Cumulative Security Update for Internet Explorer (3169991)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-3204

high

Tenable Plugins

high

high