CVE-2016-3385 — Improper Restriction of Operations within the Bounds of a Memory Buffer in Microsoft Internet Explorer

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer4 documents4 sources

Severity

7.5HIGHNVD

EPSS

18.7%

top 4.71%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Internet Explorer Msrc Internet Explorer 10 ON Windows Server 2012 Msrc Internet Explorer 11 ON Windows 10 FOR 32-bit Systems +16 more

Timeline

PublishedOct 14

Latest updateMay 14

Description

The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 1.6 | Impact: 5.9

Affected Packages19 packages

▶NVDmicrosoft/internet_explorer10, 11, 9+2

▶msrcmsrc/internet_explorer_9_on_windows_vista_service_pack_2

▶msrcmsrc/internet_explorer_9_on_windows_vista_x64_edition_service_pack_2

▶msrcmsrc/internet_explorer_11_on_windows_7_for_32-bit_systems_service_pack_1

▶msrcmsrc/internet_explorer_11_on_windows_7_for_x64-based_systems_service_pack_1

🔴Vulnerability Details

GHSA

GHSA-4qjp-f8hh-644f: The scripting engine in Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memor↗2022-05-14

▶

📋Vendor Advisories

Microsoft

Scripting Engine Memory Corruption Vulnerability↗2016-10-11

▶

🕵️Threat Intelligence

Zscaler

Zscaler found Multiple Security Vulnerabilities | 11-10-2016↗

▶