PT-2015-2036 · Microsoft · Internet Explorer 8+1

Published 2015-09-08 · Updated 2018-10-12 · CVE-2015-2493

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Internet Explorer 8

Description The issue is related to the VBScript and JScript engines in Internet Explorer, which can allow remote attackers to execute arbitrary code or cause a denial of service due to memory corruption via a crafted web site. This is caused by a buffer overflow in the implementation of these scripting engines. An attacker who successfully exploits the issue could gain the same user rights as the current user, potentially taking control of an affected system if the current user has administrative rights. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.

Recommendations For Internet Explorer 8, consider applying security updates or patches that address the scripting engine memory corruption issue to prevent remote code execution and denial of service attacks. As a temporary workaround, consider restricting the use of VBScript and JScript engines in Internet Explorer until a patch is available.

Fix

RCE

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2015-11382

CVE-2015-2493

Affected Products

Internet Explorer

Internet Explorer 8

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2015-2493 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2493 · Security Note
• https://bdu.fstec.ru/vul/2015-11382 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-094 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/ms15-094 · Note
• http://securitytracker.com/id/1033487 · Note
• http://securityfocus.com/bid/76575 · Note
• http://technet.microsoft.com/security/bulletin/MS15-094 · Note