CVE-2016-7202

EUVD-2022-4590

10.11.2016, 06:59

The scripting engines in Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability," as demonstrated by the Chakra JavaScript engine, a different vulnerability than CVE-2016-7200, CVE-2016-7201, CVE-2016-7203, CVE-2016-7208, CVE-2016-7240, CVE-2016-7242, and CVE-2016-7243.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.5 HIGH	NETWORK	HIGH	NONE	CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 99%

Affected Products (NVD)

Vendor	Product	Version
microsoft	edge	*

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64, x86)	KB3198585
(x64, x86)	KB3205383
1511 (x64, x86)	KB3198586
1511 (x64, x86)	KB3205386
1607 (x64, x86)	KB3200970
1607 (x64, x86)	KB3206632

Windows 8.1

(x64, x86)

Windows RT 8.1

All

Windows Server 2008

Service Pack 2 (x64, x86)	KB3203621
Service Pack 2 (x64, x86)	KB3208481

Windows Server 2008 R2

Service Pack 1 (x64)

Windows Server 2012

Standard

Windows Server 2012 R2

Standard

Windows Server 2016

Standard	KB3200970
Standard	KB3206632

Windows Vista

Service Pack 2	KB3203621
Service Pack 2	KB3208481
x64 Edition	KB3203621
x64 Edition	KB3208481

Common Weakness Enumeration

CWE-119 - Improper Restriction of Operations within the Bounds of a Memory Buffer
The software performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer.

References

http://www.securityfocus.com/bid/94042

http://www.securitytracker.com/id/1037245

http://www.zerodayinitiative.com/advisories/ZDI-16-593

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144

https://www.exploit-db.com/exploits/40786/

https://www.exploit-db.com/exploits/40793/

http://www.securityfocus.com/bid/94042

http://www.securitytracker.com/id/1037245

http://www.zerodayinitiative.com/advisories/ZDI-16-593

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144

https://www.exploit-db.com/exploits/40786/

https://www.exploit-db.com/exploits/40793/