Microsoft VBScript and JScript Engines Multiple Vulnerabilities Fixed by MS15-124 and MS15-126
Description
(#Several vulnerabilities have been identified in JScript and VBScript Scripting Engines:#- CVE-2015-6135: use-after-free. A remote attacker could exploit it in order to disclose the contents of memory. This vulnerability stems from an improper implementation of the VBScript "CreateObject()" function##- CVE-2015-6136: use-after-free. A remote attacker could exploit them by enticing their victim into visiting a specially formed web page in order to execute arbitrary code with victim's rights. This vulnerability stems from an improper implementation of VBScript "StrComp()", "Split()", "Replace()", "InStr()", "InStrRev()", "InStrB()", "Filter()", "Join()" and "CreateObject()" functions.)
Vulnerable Products
Vulnerable OS: Windows 2008 (Microsoft) - Itanium-based Server SP2, Server SP2, X64 Edition SP2Windows 2008 R2 (Microsoft) - X64-systems SP1Windows Vista (Microsoft) - 32 bits SP2, X64 Edition SP2Vulnerable Software: Internet Explorer (Microsoft) - 10, 10, 10, 10, 10, ..., 9.0, 9.0, 9.0, 9.0, 9.0
