Microsoft Internet Explorer 9 through 11 and Edge allow remote attackers to execute arbitrary code via a crafted web page, aka "Microsoft Browser Memory Corruption Vulnerability."

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3177358. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist due     to a failure to properly access objects in memory. A     remote attacker can exploit these vulnerabilities by     convincing a user to visit a specially crafted website,     resulting in the execution of arbitrary code in the     context of the current user. (CVE-2016-3289,     CVE-2016-3293, CVE-2016-3319, CVE-2016-3322)

  - A remote code execution vulnerability exists in the     Chakra JavaScript engine due to improper handling of     objects in memory. A remote attacker can exploit this     vulnerability by convincing a user to visit a specially     crafted website or open a specially crafted Office     document, resulting in the execution of arbitrary code     in the context of the current user. (CVE-2016-3296)

  - Multiple information disclosure vulnerabilities exist     due to improper handling of objects in  memory. A remote     attacker can exploit these vulnerabilities by convincing     a user to visit a specially crafted website, resulting     in the disclosure of sensitive information.
    (CVE-2016-3326, CVE-2016-3327)

  - An information disclosure vulnerability exists due to     improper handling of page content. A remote attacker can     exploit this vulnerability by convincing a user to visit     a specially crafted website, resulting in the disclosure     of specific files on a user's system. (CVE-2016-3329)

The version of Internet Explorer installed on the remote Windows host is missing Cumulative Security Update 3177356. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
92820	MS16-096: Cumulative Security Update for Microsoft Edge (3177358)	Nessus	Windows : Microsoft Bulletins	high
92819	MS16-095: Cumulative Security Update for Internet Explorer (3177356)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-3293

high

Tenable Plugins

high

high