Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0105, CVE-2016-0107, CVE-2016-0112, and CVE-2016-0113.

The version of Microsoft Edge installed on the remote host is missing Cumulative Security Update 3142019. It is, therefore, affected by multiple vulnerabilities :

  - Multiple remote code execution vulnerabilities exist due     to improper handling of objects in memory. An attacker     can exploit these vulnerabilities by convincing a user     to visit a specially crafted website, resulting in     execution of arbitrary code in the context of the     current user. (CVE-2016-0102, CVE-2016-0105,     CVE-2016-0109, CVE-2016-0110, CVE-2016-0111,     CVE-2016-0116, CVE-2016-0123, CVE-2016-0124,     CVE-2016-0129, CVE-2016-0130)

  - An information disclosure vulnerability exists due to     improper handling of the referrer policy. An attacker     can exploit this vulnerabilities by convincing a user     to visit a specially crafted website, resulting in the     disclosure of sensitive information about the request     context or the browsing history of a user.
    (CVE-2016-0125)

Note that CVE-2016-0116, CVE-2016-0124, and CVE-2016-0129 do not affect Windows 10, and they are only applicable to the Windows Server versions.

The version of Internet Explorer installed on the remote host is missing Cumulative Security Update 3142015. It is, therefore, affected by multiple vulnerabilities, the majority of which are remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these issues by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user.

ID	Name	Product	Family	Severity
89747	MS16-024: Cumulative Security Update for Microsoft Edge (3142019)	Nessus	Windows : Microsoft Bulletins	high
89746	MS16-023: Cumulative Security Update for Internet Explorer (3142015)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2016-0111

high

Tenable Plugins

high

high