PT-2016-2932 · Microsoft · Edge+1

Publicado 2016-11-08 · Atualizado 2018-10-12 · CVE-2016-7227

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Baixa

Vetor base

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description The issue is related to the improper handling of objects in memory by the scripting engines, which could allow a remote attacker to determine the existence of local files and potentially read unintended data. This could be used to obtain information in an attempt to further compromise the affected system. The vulnerability does not allow an attacker to execute code or elevate a user's rights directly.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that properly handles objects in memory to prevent information disclosure. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2016-02363

CVE-2016-7227

Produtos afetados

Edge

Internet Explorer

Referências · 11

• http://technet.microsoft.com/security/bulletin/MS16-129 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7227 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-142 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2016-7227 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 · Aviso do Fabricante
• http://securityfocus.com/bid/94065 · Nota
• http://technet.microsoft.com/library/security/MS16-142 · Nota
• https://osv.dev/vulnerability/CVE-2016-7227 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2016-02363 · Nota de Segurança
• http://securitytracker.com/id/1037245 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-142 · Nota