The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine Memory Corruption Vulnerability."

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote
    attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web
    site, as demonstrated by the Chakra JavaScript engine, aka "Scripting Engine Memory Corruption
    Vulnerability." (CVE-2016-3382)

The version of Internet Explorer installed on the remote Windows host is missing Cumulative Security Update 3192887. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

The version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 3192890. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
432751	SCA: security update for Microsoft.ChakraCore (GHSA-92j2-gg59-4572)	Tenable Cloud Security	SCA Checks	high
432751	SCA: security update for Microsoft.ChakraCore (GHSA-92j2-gg59-4572)	Tenable Self-Hosted Container Security	SCA Checks	high
94011	MS16-118: Cumulative Security Update for Internet Explorer (3192887)	Nessus	Windows : Microsoft Bulletins	high
93963	MS16-119: Cumulative Security Update for Microsoft Edge (3192890)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-3382

high

Tenable Plugins

high

high

high

high