The PDF library in Microsoft Edge, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allows remote attackers to obtain sensitive information via a crafted web site, aka "PDF Library Information Disclosure Vulnerability," a different vulnerability than CVE-2016-3374.

The remote Windows host is missing a security update. It is, therefore, affected by multiple information disclosure vulnerabilities in the Windows PDF Library due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this vulnerability, by convincing a user to open a specially crafted PDF file or visit a website containing specially crafted PDF content, to disclose sensitive information from memory.

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3183043. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
93474	MS16-115: Security Update for Microsoft Windows PDF Library (3188733)	Nessus	Windows : Microsoft Bulletins	medium
93465	MS16-105: Cumulative Security Update for Microsoft Edge (3183043)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-3370

medium

Tenable Plugins

medium

high