PT-2016-2932 · Microsoft · Edge+1

Published 2016-11-08 · Updated 2018-10-12 · CVE-2016-7227

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description The issue is related to the improper handling of objects in memory by the scripting engines, which could allow a remote attacker to determine the existence of local files and potentially read unintended data. This could be used to obtain information in an attempt to further compromise the affected system. The vulnerability does not allow an attacker to execute code or elevate a user's rights directly.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that properly handles objects in memory to prevent information disclosure. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2016-02363

CVE-2016-7227

Affected Products

Edge

Internet Explorer

References · 11

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7227 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-142 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7227 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7227 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-02363 · Security Note
• http://technet.microsoft.com/security/bulletin/MS16-129 · Note
• http://securityfocus.com/bid/94065 · Note
• http://technet.microsoft.com/library/security/MS16-142 · Note
• http://securitytracker.com/id/1037245 · Note
• http://technet.microsoft.com/security/bulletin/MS16-142 · Note