Microsoft Internet Explorer Cumulative Security Update

Last Update Date: 15 May 2015 Release Date: 13 May 2015 3659 Views

RISK: High Risk

TYPE: Clients - Browsers

VBScript ASLR Bypass
A security feature bypass exists when the VBScript engine fails to use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use the ASLR bypass in conjunction with another vulnerability, such as a remote code execution vulnerability, that could take advantage of the ASLR bypass to more reliably run arbitrary code on a target system.
VBScript and JScript ASLR Bypass
A security feature bypass exists when the JScript and VBScript engines fail to use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use the ASLR bypass in conjunction with another vulnerability, such as a remote code execution vulnerability, to more reliably run arbitrary code on a target system.
Internet Explorer ASLR Bypass
A security feature bypass vulnerability exists when Internet Explorer fails to use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. An attacker who successfully exploited this vulnerability could bypass the Address Space Layout Randomization (ASLR) security feature, which helps protect users from a broad class of vulnerabilities. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use this ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, to more reliably run arbitrary code on a target system.
Multiple Elevation of Privilege Vulnerabilities
Elevation of privilege vulnerabilities exist when Internet Explorer does not properly validate permissions under specific conditions, potentially allowing script to be run with elevated privileges.
Internet Explorer Clipboard Information Disclosure Vulnerability
An information disclosure vulnerability exists when Internet Explorer does not properly restrict access to the clipboard of a user who visits a website. The vulnerability could allow data stored in the Windows clipboard to be accessed by a malicious site. An attacker could collect information from the clipboard of a user if that user visits the malicious site and performs a clipboard operation.
Multiple Memory Corruption Vulnerabilities in Internet Explorer
Remote code execution vulnerabilities exist when Internet Explorer improperly accesses objects in memory. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user.