MS15-107: Microsoft Edge Information Disclosure and XSS Filter Bypass (CVE-2015-6057/6058)

Vulnerability Key Information Vulnerability Overview Security Bulletin ID: MS15-107 Title: Cumulative Security Update (3096448) Release Date: October 13, 2015 Update Date: October 16, 2015 Version: 1.1 Affected Software Operating System: Windows 10 for 32-bit Systems and Windows 10 for x64-based Systems Component: Microsoft Edge Maximum Security Impact: Information Disclosure Overall Severity Rating: Important Replaces Update: 3081455 Vulnerability Rating and Identification CVE Numbers: - CVE-2015-6057: Microsoft Edge Information Disclosure Vulnerability - CVE-2015-6058: Microsoft Edge XSS Filter Bypass Maximum Impact: Information Disclosure Vulnerability Details Information Disclosure Vulnerability (CVE-2015-6057): - An information disclosure vulnerability exists when Microsoft Edge incorrectly discloses memory contents. XSS Filter Bypass (CVE-2015-6058): - A cross-site scripting (XSS) filter bypass exists, allowing attackers to craft specific content that can cause scripts to execute on third-party websites. Mitigations and Workarounds Microsoft has not identified any specific mitigations or workarounds for these vulnerabilities. Security Update Deployment In the cumulative security update for Microsoft Edge, the information disclosure vulnerability was resolved by modifying how certain functions handle memory objects. The XSS filter bypass issue was resolved by preventing Microsoft Edge’s XSS filter from incorrectly disabling HTML attributes.

Goal Reached Thanks to every supporter — we hit 100%!

MS15-107: Microsoft Edge Information Disclosure and XSS Filter Bypass (CVE-2015-6057/6058)