60
CVE-2015-2419
KEVmassMemory Corruption RCE in Microsoft Internet Explorer JScript Engine
CISA: Microsoft Internet Explorer Memory Corruption Vulnerability
CVSS
—
EPSS
53%p99
Published
—
KEV added
AI analysis
CVE-2015-2419 is a memory corruption flaw (CWE-119) in the JScript engine used by Microsoft Internet Explorer, allowing remote attackers to execute arbitrary code or cause a denial of service through a crafted website. It is triggered when a user visits an attacker-controlled page whose JScript content corrupts memory in the affected browser process. A successful attacker gains remote code execution in the context of the logged-on user (or crashes the browser), which makes drive-by and exploit-kit delivery routes viable. Any Windows user running the affected versions of Internet Explorer at the time of disclosure was exposed, and Microsoft shipped fixes as part of its July 2015 security updates. The flaw is listed in CISA's Known Exploited Vulnerabilities catalog (added 2022-03-28), carries a 53.4% EPSS (99th percentile), and related reporting places it among the top vulnerabilities used by exploit kits in 2015-2016.
What to do: Apply Microsoft's July 2015 security updates for Internet Explorer per vendor instructions, as required by the CISA KEV catalog, and verify that any legacy Windows systems still running Internet Explorer have received them. Because exploitation typically occurs via drive-by web attacks, retire or fully patch IE on client endpoints and keep endpoint protection enabled to catch exploit-kit delivery. Confirm no workstations remain on unpatched IE builds, since this entry has been in CISA KEV since March 2022 and exploitation probability remains high (EPSS 53.4%).
Affected
| Microsoft Internet Explorer | — |
Estimated exposure
masshundreds of millions of Windows users running Internet Explorer at the time of disclosure — Internet Explorer held majority desktop browser market share in 2015 across the billion-plus Windows install base, and the flaw is reachable simply by visiting a crafted website, so the plausible affected population is on the order of…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
JScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.
CISA Known Exploited Vulnerability
- Affected
- Microsoft Internet Explorer
- Required action
- Apply updates per vendor instructions.
- Due date
- Ransomware use
- Unknown
- Vendors
- Microsoft
- Products
- Internet Explorer
- Weakness
- CWE-119
In the news13 stories
60
60
47
47
47
47
Understanding Angler Exploit Kit
Unit 42 examines Angler EK operations, including rapid zero-day adoption, fileless Bedep infections, and ransomware payloads like TeslaCrypt and CryptXXX.
Unit 42 published the second part of its Angler EK analysis, covering the kit's history since 2013, its SaaS rental model, and its focus on Flash, Internet Explorer, and Silverlight exploits. Angler integrated the CVE-2015-5119 Flash zero-day from the Hacking Team leak within hours and later added exploits for CVE-2015-2419 and CVE-2016-0034 roughly a month after Microsoft patched them. Campaigns use Angler to deliver ransomware such as CryptoWall, TeslaCrypt, and CryptXXX, plus banking trojans and stealers via EITest. Since August 2014, Angler has used fileless, in-memory execution, most often for Bedep, which later downloads CryptXXX and click-fraud malware.
36
35
35
35
35
35