Kaspersky Threats

Detect date

?

11/08/2016

Severity

?

Critical

Description

Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, execute arbitrary code.

Below is a complete list of vulnerabilities:

An information disclosure vulnerability in Microsoft Browser can be exploited remotely via specially crafted application to obtain sensitive information.
A spoofing vulnerability in Microsoft Browser can be exploited remotely via specially crafted website to spoof user interface.
An information disclosure vulnerability in Microsoft Browser can be exploited remotely via specially crafted content to obtain sensitive information.
A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
A memory corruption vulnerability in Microsoft Browser can be exploited remotely via specially crafted website to execute arbitrary code.
An information disclosure vulnerability in Microsoft Browser can be exploited remotely to obtain sensitive information.
An information disclosure vulnerability in Microsoft Edge can be exploited remotely to obtain sensitive information.

Affected products

Internet Explorer 9
Microsoft Windows Hyperlink Object Library
Internet Explorer 11
Internet Explorer 10
Microsoft Edge (EdgeHTML-based)

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories

CVE-2016-7239
CVE-2016-7209
CVE-2016-7227
CVE-2016-7208
CVE-2016-7195
CVE-2016-7196
CVE-2016-7198
CVE-2016-7199
CVE-2016-7200
CVE-2016-7201
CVE-2016-7202
CVE-2016-7203
CVE-2016-7204
CVE-2016-7243
CVE-2016-7242
CVE-2016-7241
CVE-2016-7240

Impacts

?

ACE

[?]

OSI

[?]

SUI

[?]

Detect date ?	11/08/2016
Severity ?	Critical
Description	Multiple vulnerabilities were found in Microsoft Browser. Malicious users can exploit these vulnerabilities to obtain sensitive information, spoof user interface, execute arbitrary code. Below is a complete list of vulnerabilities: An information disclosure vulnerability in Microsoft Browser can be exploited remotely via specially crafted application to obtain sensitive information. A spoofing vulnerability in Microsoft Browser can be exploited remotely via specially crafted website to spoof user interface. An information disclosure vulnerability in Microsoft Browser can be exploited remotely via specially crafted content to obtain sensitive information. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code. A memory corruption vulnerability in Microsoft Browser can be exploited remotely via specially crafted website to execute arbitrary code. An information disclosure vulnerability in Microsoft Browser can be exploited remotely to obtain sensitive information. An information disclosure vulnerability in Microsoft Edge can be exploited remotely to obtain sensitive information.
Affected products	Internet Explorer 9 Microsoft Windows Hyperlink Object Library Internet Explorer 11 Internet Explorer 10 Microsoft Edge (EdgeHTML-based)
Solution	Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)
Original advisories	CVE-2016-7239 CVE-2016-7209 CVE-2016-7227 CVE-2016-7208 CVE-2016-7195 CVE-2016-7196 CVE-2016-7198 CVE-2016-7199 CVE-2016-7200 CVE-2016-7201 CVE-2016-7202 CVE-2016-7203 CVE-2016-7204 CVE-2016-7243 CVE-2016-7242 CVE-2016-7241 CVE-2016-7240
Impacts ?	ACE [?] OSI [?] SUI [?]
Related products	Microsoft Internet Explorer Microsoft Windows Microsoft Edge
CVE-IDS ?	CVE-2016-72392.6Warning CVE-2016-72092.6Warning CVE-2016-72272.6Warning CVE-2016-72087.6Critical CVE-2016-71957.6Critical CVE-2016-71967.6Critical CVE-2016-71987.6Critical CVE-2016-71992.6Warning CVE-2016-72007.6Critical CVE-2016-72017.6Critical CVE-2016-72027.6Critical CVE-2016-72037.6Critical CVE-2016-72042.6Warning CVE-2016-72437.6Critical CVE-2016-72427.6Critical CVE-2016-72417.6Critical CVE-2016-72407.6Critical
Microsoft official advisories	Microsoft Security Update Guide
KB list	3200970 3197867 3197868 3197873 3197874 3197876 3197877 3198585 3198586 3205386 3205383 3205401 3205400 3205408 3205409 3207752 3205394 3206632
Exploitation	The following public exploits exists for this vulnerability: https://www.exploit-db.com/exploits/40990 https://www.exploit-db.com/exploits/40785 https://www.exploit-db.com/exploits/40990 https://www.exploit-db.com/exploits/40784 https://www.exploit-db.com/exploits/40793 https://www.exploit-db.com/exploits/40786 https://www.exploit-db.com/exploits/40787 https://www.exploit-db.com/exploits/40875 https://www.exploit-db.com/exploits/40773 Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.
	Find out the statistics of the vulnerabilities spreading in your region

KLA10900Multiple vulnerabilities in Microsoft Browser

KLA10900
Multiple vulnerabilities in Microsoft Browser