KLA11098
Multiple vulnerabilities in Microsoft Edge and Microsoft Internet Explorer

Multiple serious vulnerabilities have been found in Microsoft Edge and Microsoft Internet Explorer. Malicious users can exploit these vulnerabilities to obtain sensitive information, execute arbitrary code, bypass security restrictions and spoof user interface.

Below is a complete list of vulnerabilities:

1. Multiple vulnerabilities related to improper handling of objects in memory in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
2. An improper handling of clipboard events in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
3. An incorrect parent domain verification in Microsoft browsers can be exploited remotely via a specially designed website to obtain sensitive information;
4. An incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to obtain sensitive information;
5. Multiple vulnerabilities related to incorrect handling of objects in memory in the scripting engine in Microsoft Edge can be exploited remotely via a specially designed website to execute arbitrary code;
6. Multiple vulnerabilities related to improper access of objects in memory in Microsoft browsers can be exploited remotely via a specially designed website to execute arbitrary code;
7. Multiple vulnerabilities related to improper handling of objects in memory in JavaScript engines in Microsoft browsers during rendering content can be exploited remotely via a specially designed website to execute arbitrary code;
8. Multiple vulnerabilities related to improper validation of documents in Microsoft Edge can be exploited remotely via a specially designed website to bypass security restrictions;
9. Multiple vulnerabilities related to incorrect parsing of HTTP content in Microsoft Edge can be exploited remotely via a specially designed website to spoof user interface;
10. An improper handling of HTTP content in Microsoft Internet Explorer can be exploited remotely via a specially designed website to spoof user interface;
11. Multiple vulnerabilities related to incorrect handling of objects in memory in Microsoft Windows PDF Library can be exploited remotely via a specially designed website to execute arbitrary code.

NB: Not every vulnerability already has CVSS rating, so cumulative CVSS rating can be not representative.

Microsoft Internet Explorer versions 9 through 11
Microsoft Edge

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

4038788
4038782
4038783
4038792
4038799
4038781
4038777
4036586

The following public exploits exists for this vulnerability:

https://www.exploit-db.com/exploits/42759

https://www.exploit-db.com/exploits/42763

https://www.exploit-db.com/exploits/42758

https://www.exploit-db.com/exploits/42764

https://www.exploit-db.com/exploits/42765

https://www.exploit-db.com/exploits/43151

https://www.exploit-db.com/exploits/42766

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.