⚠ Actively exploited
Added to CISA KEV on 2022-05-25. Federal agencies required to patch by 2022-06-15. Required action: Apply updates per vendor instructions..
CVE-2015-2425 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Internet Explorer
Severity
9.3CRITICALNVD
NVD8.8VulnCheck8.8CISA8.8
EPSS
34.1%
top 3.02%
CISA KEV
KEV
Added 2022-05-25
Due 2022-06-15
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedJul 14
KEV addedMay 25
KEV dueJun 15
CISA Required Action: Apply updates per vendor instructions.
Description
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2015-2383 and CVE-2015-2384.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9
Affected Packages1 packages
Patches
🔴Vulnerability Details
7GHSA▶
GHSA-cv93-w72p-jgh2: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si↗2022-05-14
GHSA▶
GHSA-8g84-cghm-g8cv: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si↗2022-05-14
GHSA▶
GHSA-587g-667r-mqj5: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si↗2022-05-14
CVEList▶
CVE-2015-2425: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si↗2015-07-14
CVEList▶
CVE-2015-2384: Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web si↗2015-07-14