Microsoft Internet Explorer Security Update

Last Update Date: 11 Feb 2015 10:20 Release Date: 11 Feb 2015 3639 Views

RISK: High Risk

TYPE: Clients - Browsers

Multiple Memory Corruption Vulnerabilities in Internet Explorer
Remote code execution vulnerabilities exist when Internet Explorer improperly accesses objects in memory. These vulnerabilities could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. The update addresses the vulnerabilities by modifying the way that Internet Explorer handles objects in memory.
Multiple Elevation of Privilege Vulnerabilities in Internet Explorer
Elevation of privilege vulnerabilities exist when Internet Explorer does not properly validate permissions under specific conditions, potentially allowing script to be run with elevated privileges. The update addresses the vulnerabilities by adding additional permission validations to Internet Explorer.
Multiple Internet Explorer ASLR Bypass Vulnerabilities
Security feature bypass vulnerabilities exist when Internet Explorer does not use the Address Space Layout Randomization (ASLR) security feature, allowing an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. An attacker who successfully exploited these vulnerabilities could bypass the Address Space Layout Randomization (ASLR) security feature, which helps protect users from a broad class of vulnerabilities. The security feature bypass by itself does not allow arbitrary code execution. However, an attacker could use a ASLR bypass vulnerability in conjunction with another vulnerability, such as a remote code execution vulnerability, that could take advantage of the ASLR bypass to run arbitrary code. For example, a remote code execution vulnerability that is blocked by ASLR, could be exploited after a successful ASLR bypass.
Internet Explorer Cross-domain Information Disclosure Vulnerability
An information disclosure vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to gain access to information in another domain or Internet Explorer zone. The update addresses the vulnerability by helping to ensure that cross-domain policies are properly enforced in Internet Explorer.