PT-2015-1659 · Microsoft · Internet Explorer

Published 2015-07-14 · Updated 2018-10-12 · CVE-2015-2412

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 10 through 11

Description The issue allows remote attackers to read arbitrary local files via a crafted pathname. This is due to the browser's failure to properly validate file paths, which could enable an attacker to disclose the contents of arbitrary files on the user's computer. The vulnerability does not allow an attacker to execute code or elevate their user rights directly but could be used to obtain information that could be used to try to further compromise the affected system.

Recommendations For versions 10 and 11, consider restricting access to sensitive local files until a patch is available. As a temporary workaround, avoid using Internet Explorer to access sensitive information until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Information Disclosure

Weakness Enumeration

CWE-20

CWE-200

Related Identifiers

BDU:2015-11005

CVE-2015-2412

ZDI-15-331

Affected Products

Internet Explorer

References · 9

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2412 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-2412 · Security Note
• https://bdu.fstec.ru/vul/2015-11005 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-15-331 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-065 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS15-065 · Note
• http://technet.microsoft.com/security/bulletin/ms15-065 · Note
• http://securitytracker.com/id/1032894 · Note
• http://securityfocus.com/bid/75687 · Note