XLAB ID: XLAB-15-003     

CVE ID: CVE-2015-2494     

Patch Status: Fixed

Vulnerability Details:
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer and Microsoft Edge. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.The vulnerability relates to SecurityContext objects. By manipulating a document’s elements an attacker can force a SecurityContext object in memory to be reused after it has been freed. An attacker can leverage this vulnerability to execute code under the context of the current process.

Disclosure Timeline:

2015/06/09 provide vulnerability detail to Microsoft Security Response Center via secure@microsoft.com
2015/06/10 Microsoft Security Response Center automatic reply
2015/06/23 Microsoft Security Response Center responded that they are verifying the proof of concept code
2015/09/08 Microsoft Security Response Center assigned CVE-ID CVE-2015-2494

Credit:
This vulnerability was discovered by:   exp-sky