PT-2016-2903 · Microsoft · Edge+1

Published 2016-10-11 · Updated 2018-10-12 · CVE-2016-3267

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description The issue allows an attacker to determine the existence of unspecified files via a crafted web site. An information disclosure vulnerability exists when the browsers do not properly handle objects in memory, potentially allowing an attacker to read data that was not intended to be disclosed. This vulnerability could be used to obtain information in an attempt to further compromise the affected system, but it would not allow an attacker to execute code or to elevate a user’s rights directly.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that includes the fix for this issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-02334

CVE-2016-3267

Affected Products

Edge

Internet Explorer

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3267 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3267 · Security Note
• https://bdu.fstec.ru/vul/2016-02334 · Security Note
• https://osv.dev/vulnerability/CVE-2016-3267 · Vendor Advisory
• http://technet.microsoft.com/library/security/MS16-118 · Note
• http://securitytracker.com/id/1036993 · Note
• http://technet.microsoft.com/security/bulletin/MS16-119 · Note
• http://technet.microsoft.com/security/bulletin/MS16-118 · Note
• http://securitytracker.com/id/1036992 · Note
• http://securityfocus.com/bid/93376 · Note