PT-2016-3012 · Microsoft · Edge+1

Publicado 2016-12-13 · Atualizado 2018-10-12 · CVE-2016-7282

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This is due to the browsers not taking measures to protect the structure of web pages, which could enable a remote attacker to inject arbitrary code. The vulnerability exists because Microsoft Browsers do not properly validate content under specific conditions, and the affected component does not handle objects in memory correctly. An attacker who exploits this issue could run arbitrary code, leading to information disclosure, and potentially obtain information to further compromise a target system.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that includes the fix for this issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2017-00096

CVE-2016-7282

Produtos afetados

Edge

Internet Explorer

Referências · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7282 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2016-7282 · Nota de Segurança
• http://technet.microsoft.com/library/security/MS16-145 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-145 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-7282 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/MS16-144 · Nota
• http://securitytracker.com/id/1037444 · Nota
• https://bdu.fstec.ru/vul/2017-00096 · Nota de Segurança
• http://securityfocus.com/bid/94724 · Nota
• http://technet.microsoft.com/library/security/MS16-144 · Nota