| Description: | Summary:
This host is missing a critical security
update according to Microsoft Bulletin MS16-119.
Vulnerability Insight:
Multiple flaws exist due to:
- A remote code execution exist in the way that the Chakra JavaScript engine
renders when handling objects in memory.
- A remote code execution vulnerability exists in the way that Microsoft
Edge improperly handles objects in memory.
- An information disclosure exists when Microsoft browsers leave credential
data in memory.
- Multiple information disclosure exists when the Microsoft Edge improperly
handles objects in memory.
- An elevation of privilege when Microsoft Edge fails to properly secure
private namespace.
- A security feature bypass flaw exists when the Edge Content Security Policy
fails to properly handle validation of certain specially crafted documents.
Vulnerability Impact:
Successful exploitation will allow remote
attackers to execute arbitrary code in the context of the current user, and
obtain information to further compromise the users system.
Affected Software/OS:
- Microsoft Windows 10 x32/x64
- Microsoft Windows 10 Version 1511 x32/x64
- Microsoft Windows 10 Version 1607 x32/x64
Solution:
The vendor has released updates. Please see the references for more information.
CVSS Score:
9.3
CVSS Vector:
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
