The Microsoft (1) VBScript 5.6 through 5.8 and (2) JScript 5.6 through 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "VBScript and JScript ASLR Bypass."

The JScript and/or VBScript scripting engines installed on the remote Windows host are affected by multiple ASLR security feature bypass vulnerabilities, which allow an attacker to more reliably predict the memory offsets of specific instructions in a given call stack. A remote attacker can exploit these along with another vulnerability to more reliably run arbitrary code.

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3049563. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website.

ID	Name	Product	Family	Severity
83364	MS15-053: Vulnerabilities in JScript and VBScript Scripting Engines Could Allow Security Feature Bypass (3057263)	Nessus	Windows : Microsoft Bulletins	medium
83358	MS15-043: Cumulative Security Update for Internet Explorer (3049563)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2015-1686

medium

Tenable Plugins

medium

high