The OLE Automation mechanism and VBScript scripting engine in Microsoft Internet Explorer 9 through 11, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

The remote Windows host is missing a security update. It is, therefore, affected by a remote code execution vulnerability in the Microsoft OLE Automation mechanism and the VBScript Scripting Engine due to improper handling of objects in memory. An unauthenticated, remote attacker can exploit this, by convincing a user to visit a specially crafted website, to execute arbitrary code in context of the current user.

Note that MS16-104 must also be installed in order to fully resolve the vulnerability.

The version of Internet Explorer installed on the remote Windows host is missing Cumulative Security Update 3183038. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
93651	MS16-116: Security Update in OLE Automation for VBScript Scripting Engine (3188724)	Nessus	Windows : Microsoft Bulletins	high
93464	MS16-104: Cumulative Security Update for Internet Explorer (3183038)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-3375

high

Tenable Plugins

high

high