KLA11265
Multiple vulnerabilities in Microsoft Internet Explorer & Edge

Multiple vulnerabilities were found in Microsoft Browsers. Malicious users can exploit these vulnerabilities to execute arbitrary code, bypass security restrictions, obtain sensitive information.

Below is a complete list of vulnerabilities:

1. A memory corruption vulnerability in Chakra Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
2. A memory corruption vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to execute arbitrary code.
3. A security feature bypass vulnerability in Internet Explorer can be exploited remotely via specially crafted to bypass security restrictions.
4. An information disclosure vulnerability in Microsoft Edge based on Edge HTML can be exploited remotely via specially crafted content to obtain sensitive information.
5. A memory corruption vulnerability in Internet Explorer can be exploited remotely via specially crafted website to execute arbitrary code.
6. A security feature bypass vulnerability in Microsoft Edge can be exploited remotely via specially crafted website to bypass security restrictions.
7. A memory corruption vulnerability in Scripting Engine can be exploited remotely via specially crafted website to execute arbitrary code.
8. An information disclosure vulnerability in Microsoft Edge can be exploited remotely to obtain sensitive information.
9. A memory corruption vulnerability in ChakraCore can be exploited remotely to execute arbitrary code.

Technical details

Vulnerability (4) allows to bypass Mark of the Web Tagging (MOTW).

Internet Explorer 10
Internet Explorer 11
Internet Explorer 9
ChakraCore
Microsoft Edge (EdgeHTML-based)

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

4284860
4284874
4284826
4284835
4284880
4284819
4230450
4284855
4284815
4532693
4532691

The following public exploits exists for this vulnerability:

https://www.exploit-db.com/exploits/45013