Published: 14/10/2015 Updated: 12/10/2018

CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6

VMScore: 935

Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

The Microsoft (1) VBScript 5.7 and 5.8 and (2) JScript 5.7 and 5.8 engines, as used in Internet Explorer 8 through 11 and other products, allow remote malicious users to execute arbitrary code or cause a denial of service (memory corruption) via a crafted replace operation with a JavaScript regular expression, aka "Scripting Engine Memory Corruption Vulnerability."

Vulnerable Product	Search on Vulmon	Subscribe to Product
microsoft vbscript 5.6
microsoft vbscript 5.7
microsoft vbscript 5.8
microsoft jscript 5.6
microsoft jscript 5.7
microsoft jscript 5.8

<!-- Source: blogskylinednl/20161116001html Synopsis A specially crafted web-page can cause the Javascript engine of Microsoft Internet Explorer 8 to free memory used for a string The code will keep a reference to the string and can be forced to reuse it when compiling a regular expression Known affected software, attack vectors a ...

Recompiling the regular expression pattern during a replace in JScript version 57 (MSIE 8) can cause the code to reuse a freed string, but only if the string is freed from the cache by allocating and freeing a number of strings of certain size ...

A specially crafted web-page can cause the Javascript engine of Microsoft Internet Explorer 8 to free memory used for a string The code will keep a reference to the string and can be forced to reuse it when compiling a regular expression ...

CWE-119 http://www.zerodayinitiative.com/advisories/ZDI-15-515 http://seclists.org/fulldisclosure/2015/Oct/54 http://www.securitytracker.com/id/1033800 https://www.exploit-db.com/exploits/40798/https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-108 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-106 https://nvd.nist.gov https://www.exploit-db.com/exploits/40798/

CVE-2015-2482

Vulnerability Summary

Vulnerability Trend

Exploits

References

Vulmon Search

About

Products

Connect