The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft
    Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code
    or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory
    Corruption Vulnerability." (CVE-2016-3260)

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3169999. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists due to a     failure to properly implement Address Space Layout     Randomization (ASLR). An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a website that hosts crafted content, to bypass the ASLR     security feature, resulting in the ability to predict     memory offsets in a call stack. (CVE-2016-3244)

  - Multiple remote code execution vulnerabilities exist due     to improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these, via a     crafted website or email, to corrupt memory, resulting in     the execution of arbitrary code within the context of the     current user. (CVE-2016-3246, CVE-2016-3264)

  - Multiple remote code execution vulnerabilities exist in     the Chakra JavaScript engine due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit these, by convincing a user to visit a     specially crafted website or open a specially crafted     Microsoft Office document that hosts the Edge rendering     engine, to corrupt memory, resulting in the execution of     arbitrary code within the context of the current user.
    (CVE-2016-3248, CVE-2016-3259, CVE-2016-3260,     CVE-2016-3265, CVE-2016-3269)

  - An information disclosure vulnerability exists in     VBScript due to improper disclosure of the contents of     its memory. An unauthenticated, remote attacker who has     knowledge of the memory address where an object was     created can exploit this issue to disclose potentially     sensitive information. (CVE-2016-3271)

  - An information disclosure vulnerability exists in the     Microsoft Browser XSS Filter due to improper validation     of content. An unauthenticated, remote attacker can     exploit this, via a website that hosts content with     specially crafted JavaScript, to disclose potentially     sensitive information. (CVE-2016-3273)

  - Multiple spoofing vulnerabilities exist due to improper     parsing of HTTP or HTML content. An unauthenticated,     remote attacker can exploit these to redirect a user     to a malicious website having spoofed contents.
    (CVE-2016-3274, CVE-2016-3276)

  - An unspecified information disclosure vulnerability     exists due to improper handling of objects in memory     that allows an unauthenticated, remote attacker to     disclose potentially sensitive information.
    (CVE-2016-3277)

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3169991. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Type	Severity
432756	SCA: security update for Microsoft.ChakraCore (GHSA-h6g3-73h7-chxp)	Tenable Cloud Security	SCA Checks	Local	high
432756	SCA: security update for Microsoft.ChakraCore (GHSA-h6g3-73h7-chxp)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
92016	MS16-085: Cumulative Security Update for Microsoft Edge (3169999)	Nessus	Windows : Microsoft Bulletins	Local	high
92015	MS16-084: Cumulative Security Update for Internet Explorer (3169991)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2016-3260

high

Tenable Plugins

high

high

high

high