MS16-119  Cumulative Security Update for Microsoft Edge

2016-10-11 This security update resolves vulnerabilities in Microsoft Edge. The most severe of the vulnerabilities could allow remote code execution if a user views a specially crafted webpage using Microsoft Edge. An attacker who successfully exploited the vulnerabilities could gain the same user rights as the current user. Customers whose accounts are configured to have fewer user rights on the system could be less impacted than users with administrative user rights.
Vulnerabilities addressed in this bulletin:

Microsoft Browser Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft Edge does not properly handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer. In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability.
CVE-2016-3267

Microsoft Browser Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that Microsoft Edge handles objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user.
CVE-2016-3331

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
CVE-2016-3382

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
CVE-2016-3386

Microsoft Browser Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Edge fails to properly secure private namespace. An attacker who successfully exploited the vulnerability could gain elevated permissions on the namespace directory of a vulnerable system and gain elevated privileges.
CVE-2016-3387

Microsoft Browser Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Edge fails to properly secure private namespace. An attacker who successfully exploited the vulnerability could gain elevated permissions on the namespace directory of a vulnerable system and gain elevated privileges.
CVE-2016-3388

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
CVE-2016-3389

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
CVE-2016-3390

Microsoft Browser Information Disclosure Vulnerability

An information disclosure vulnerability exists when Microsoft browsers leave credential data in memory. An attacker who successfully exploited this vulnerability could harvest credentials from a memory dump of the browser process. An attacker would need access to a memory dump from the affected system.
CVE-2016-3391

Microsoft Edge Security Feature Bypass

A security feature bypass vulnerability exists when the Edge Content Security Policy fails to properly handle validation of certain specially crafted documents.
CVE-2016-3392

Scripting Engine Information Disclosure Vulnerability

An Information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
CVE-2016-7189

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
CVE-2016-7190

Scripting Engine Memory Corruption Vulnerability

A remote code execution vulnerability exists in the way that the Chakra JavaScript engine renders when handling objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
CVE-2016-7194

Bulletin details at Microsoft.com