The XSS Filter in Microsoft Internet Explorer 9 through 11 and Microsoft Edge does not properly restrict JavaScript code, which allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3169999. It is, therefore, affected by multiple vulnerabilities :

  - A security feature bypass vulnerability exists due to a     failure to properly implement Address Space Layout     Randomization (ASLR). An unauthenticated, remote     attacker can exploit this, by convincing a user to visit     a website that hosts crafted content, to bypass the ASLR     security feature, resulting in the ability to predict     memory offsets in a call stack. (CVE-2016-3244)

  - Multiple remote code execution vulnerabilities exist due     to improper handling of objects in memory. An     unauthenticated, remote attacker can exploit these, via a     crafted website or email, to corrupt memory, resulting in     the execution of arbitrary code within the context of the     current user. (CVE-2016-3246, CVE-2016-3264)

  - Multiple remote code execution vulnerabilities exist in     the Chakra JavaScript engine due to improper handling of     objects in memory. An unauthenticated, remote attacker     can exploit these, by convincing a user to visit a     specially crafted website or open a specially crafted     Microsoft Office document that hosts the Edge rendering     engine, to corrupt memory, resulting in the execution of     arbitrary code within the context of the current user.
    (CVE-2016-3248, CVE-2016-3259, CVE-2016-3260,     CVE-2016-3265, CVE-2016-3269)

  - An information disclosure vulnerability exists in     VBScript due to improper disclosure of the contents of     its memory. An unauthenticated, remote attacker who has     knowledge of the memory address where an object was     created can exploit this issue to disclose potentially     sensitive information. (CVE-2016-3271)

  - An information disclosure vulnerability exists in the     Microsoft Browser XSS Filter due to improper validation     of content. An unauthenticated, remote attacker can     exploit this, via a website that hosts content with     specially crafted JavaScript, to disclose potentially     sensitive information. (CVE-2016-3273)

  - Multiple spoofing vulnerabilities exist due to improper     parsing of HTTP or HTML content. An unauthenticated,     remote attacker can exploit these to redirect a user     to a malicious website having spoofed contents.
    (CVE-2016-3274, CVE-2016-3276)

  - An unspecified information disclosure vulnerability     exists due to improper handling of objects in memory     that allows an unauthenticated, remote attacker to     disclose potentially sensitive information.
    (CVE-2016-3277)

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3169991. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
92016	MS16-085: Cumulative Security Update for Microsoft Edge (3169999)	Nessus	Windows : Microsoft Bulletins	high
92015	MS16-084: Cumulative Security Update for Internet Explorer (3169991)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-3273

medium

Tenable Plugins

high

high