Skylined

Name of the Vulnerable Software and Affected Versions: Internet Explorer versions in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 Description: An information disclosure issue exists due to how Internet Explorer handles objects in memory. This could allow an attacker to obtain information to further compromise the user's system. Recommendations: For Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Thunderbird versions prior to 52.3 Firefox ESR versions prior to 52.3 Firefox versions prior to 55 **Description** An out-of-bounds read occurs when applying style rules to pseudo-elements, such as `::first-line`, using cached style data. This issue can be exploited by a remote attacker to cause a denial of service. **Recommendations** For Thunderbird versions prior to 52.3, update to version 52.3 or later. For Firefox ESR versions prior to 52.3, update to version 52.3 or later. For Firefox versions prior to 55, update to version 55 or later.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer version 11 Microsoft Edge (affected versions not specified) **Description** The issue is related to the handling of objects in memory, which can lead to information disclosure. An attacker could exploit this by using a specially crafted web site to obtain sensitive information. This could potentially allow the attacker to further compromise a target system. **Recommendations** For Internet Explorer version 11: At the moment, there is no information about a newer version that contains a fix for this vulnerability. For Microsoft Edge: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer version 11 Microsoft Edge (affected versions not specified) **Description** The issue is related to memory corruption and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site. Multiple remote code execution vulnerabilities exist in the way that Internet Explorer and Microsoft Edge access and handle objects in memory, which could corrupt memory and allow an attacker to execute arbitrary code in the context of the current user. If the current user has administrative user rights, the attacker could take control of an affected system, install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Internet Explorer version 11, update to a newer version to mitigate the risk. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting access to potentially vulnerable web sites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 9 through 11 **Description** The issue is related to memory corruption and allows remote attackers to execute arbitrary code or cause a denial of service via a crafted web site. Multiple remote code execution vulnerabilities exist in the way that Internet Explorer accesses objects in memory, which could corrupt memory and allow an attacker to execute arbitrary code in the context of the current user. If the current user has administrative user rights, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft Internet Explorer versions 9 through 11, update to a newer version to mitigate the risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer (affected versions not specified) **Description** The issue is caused by a buffer overflow. It allows a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted website. The vulnerability exists due to improper access to objects in memory, which could corrupt memory and allow an attacker to execute arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view or modify data, or create new accounts with full rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue is caused by a buffer overflow. It may allow a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted web site. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer (affected versions not specified) **Description** The issue is caused by a buffer overflow. It allows a remote attacker to execute arbitrary code or cause a denial of service (memory corruption) by using a specially crafted website. The vulnerability occurs when Internet Explorer improperly accesses objects in memory, potentially corrupting memory and allowing an attacker to execute arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take control of the system, install programs, view or modify data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Edge (affected versions not specified) **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This is caused by improper access to objects in memory, potentially leading to memory corruption that enables an attacker to execute arbitrary code in the context of the current user. If the user has administrative rights, a successful exploitation could grant the attacker control over the affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer versions 8 through 11 VBScript versions 5.7 and 5.8 JScript versions 5.7 and 5.8 **Description** A remote code execution issue exists due to a memory corruption flaw in the VBScript and JScript engines. This allows attackers to execute arbitrary code or cause a denial of service via a crafted replace operation with a JavaScript regular expression. An attacker who successfully exploits this issue could gain the same user rights as the current user, potentially taking control of an affected system if the user has administrative rights. **Recommendations** For Internet Explorer versions 8 through 11, update to a version that includes the fix for this issue. For VBScript versions 5.7 and 5.8, consider disabling the scripting engine until a patch is available. For JScript versions 5.7 and 5.8, restrict the use of JavaScript regular expressions in replace operations to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Mozilla Firefox versions prior to 40.0 **Description** The issue is related to a use-after-free vulnerability in the MediaStream playback feature. This vulnerability allows remote attackers to execute arbitrary code via unspecified use of the Web Audio API. The estimated number of potentially affected devices worldwide is not available. There is no information about real-world incidents where this issue was exploited. **Recommendations** For versions prior to 40.0, update to version 40.0 or later to resolve the issue. As a temporary workaround, consider disabling the MediaStream playback feature until a patch is available. Restrict access to the Web Audio API to minimize the risk of exploitation. Avoid using the Web Audio API in affected versions until the issue is resolved.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 44.0.2403.89 **Description** The issue is related to a use-after-free vulnerability in the accessibility implementation. This vulnerability can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. The exploitation is possible due to the lack of certain validity checks for accessibility-tree data structures. **Recommendations** For Google Chrome versions prior to 44.0.2403.89, update to version 44.0.2403.89 or later to resolve the issue.

**Name of the Vulnerable Software and Affected Versions** Internet Explorer version 9 **Description** The issue is related to memory management errors. It could allow a remote attacker to execute arbitrary code or cause a denial of service by using a specially crafted website. This vulnerability could corrupt memory, enabling an attacker to execute arbitrary code in the context of the current user. If the user has administrative rights, a successful exploitation could grant the attacker complete control over the affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Internet Explorer version 9, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to specially crafted websites to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Google Chrome versions prior to 41.0.2272.76 Opera (affected versions not specified) **Description** The issue is related to a name conflict in the `getHiddenProperty` function, which can be exploited by remote attackers to cause a denial of service or possibly have other unspecified impacts. This can be achieved through JavaScript code that adds an `AudioContext` event listener and triggers "type confusion." The estimated number of potentially affected devices worldwide is not specified. **Recommendations** For Google Chrome versions prior to 41.0.2272.76, update to version 41.0.2272.76 or later to resolve the issue. For Opera, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Microsoft Internet Explorer 8 and 9 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2014-8967 and CVE-2015-0044.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer (affected versions not specified) **Description** The issue is related to a use-after-free condition in the CMapElement, which can lead to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft VBScript versions 5.6 through 5.8 **Description** A remote code execution issue exists in the way the VBScript engine handles objects in memory when rendered in Internet Explorer. This issue may corrupt memory, allowing an attacker to execute arbitrary code in the context of the current user. If the current user has administrative rights, an attacker could take complete control of the affected system, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights. **Recommendations** For Microsoft VBScript versions 5.6 through 5.8, update to a version outside of this range to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 8 through 11 **Description** The issue allows remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This is caused by improper access to objects in memory, which could corrupt memory and allow an attacker to execute arbitrary code in the context of the current user. **Recommendations** For Microsoft Internet Explorer versions 8 through 11, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer (affected versions not specified) **Description** Remote code execution vulnerabilities exist due to improper access to objects in memory. These vulnerabilities could corrupt memory, allowing an attacker to execute arbitrary code in the context of the current user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Microsoft Internet Explorer versions 8 through 11 **Description** The issue is related to incorrect access to objects in memory, which can cause a memory error and allow an attacker to execute arbitrary code in the context of the current user. This can be achieved via a crafted web site, potentially leading to memory corruption or denial of service. **Recommendations** For Microsoft Internet Explorer versions 8 through 11, update to a version that includes the fix for this issue to prevent remote code execution and denial of service. At the moment, there is no information about a newer version that contains a fix for this vulnerability.