vulnerability: Microsoft Internet Explorer 7/8/9/10/11 buffer overflow [CVE-2015-2502] : 8/19/2015 10:58:17 AM

Group Chat & IM for Teams

Communicate with co-workers in real time. Used by Netflix, Dropbox & Salesforce. $0/unlimited users. Get started >>

From our sponsors

Vulnerability Advisories

Vulnerabilities of scip VulDB

Microsoft Internet Explorer 7/8/9/10/11 buffer overflow [CVE-2015-2502]
8/17/2015 7:00:00 PM

General

scipID: 77328
Affected: Microsoft Internet Explorer 7/8/9/10/11
Published: 08/18/2015 (Clement Lecigne)
Risk: critical

Created: 08/19/2015
Entry: 74.5% complete

Summary

A vulnerability classified as critical has been found in Microsoft Internet Explorer 7/8/9/10/11. Affected is an unknown function. The manipulation with an unknown input leads to a buffer overflow vulnerability. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 08/18/2015 by Clement Lecigne with Google as MS15-093 as confirmed bulletin (Technet). The advisory is shared for download at technet.microsoft.com. This vulnerability is traded as CVE-2015-2502. It is possible to launch the attack remotely. The exploitation doesn’t require any form of authentication. There are neither technical details nor an exploit publicly available.

Applying the patch MS15-093 is able to eliminate this problem. The bugfix is ready for download at technet.microsoft.com. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability is also documented in the vulnerability database at SecurityTracker (ID 1033317).

CVSS

Base Score: 6.8 (CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P) [?]
Temp Score: 5.9 (CVSS2#E:ND/RL:OF/RC:C) [?]

CPE

Exploiting

Class: Buffer overflow
Local: No
Remote: Yes

Availability: No

Countermeasures

Recommended: Patch
Status: Official fix
Reaction Time: 0 days since reported
0-Day Time: 0 days since found
Exposure Time: 0 days since known

Patch: MS15-093

Timeline

Sources

Advisory: MS15-093
Researcher: Clement Lecigne
Company: Google
Status: Confirmed

CVE: CVE-2015-2502 (mitre.org) (nvd.nist.org) (cvedetails.com)

SecurityTracker: 1033317 – Microsoft Internet Explorer Object Access Flaw Lets Remote Users Execute Arbitrary Code

You are receiving this email because you subscribed to this feed at feedmyinbox.com

If you no longer wish to receive these emails, you can unsubscribe from this feed, or manage all your subscriptions