CVE-2015-6086

Vulnerability

CVE-2015-6086 is an out-of-bounds read vulnerability in Microsoft Internet Explorer 9, 10, and 11. It exists in the CDOMStringDataList::InitFromString function due to improper handling of newline and whitespace characters. An attacker can trigger an out-of-bounds read by manipulating a document's elements, leading to memory disclosure [1][2][3].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by hosting a specially crafted webpage and convincing a user to view it via Internet Explorer. No special privileges are required. The attacker crafts the page to cause the browser to read beyond the bounds of an allocated chunk, leaking memory contents such as the base address of MSHTML.DLL [2][3].

Impact

Successful exploitation results in information disclosure from process memory, specifically leaking the base address of MSHTML.DLL. This allows an attacker to bypass Address Space Layout Randomization (ASLR), which can then be used as part of a broader exploit chain [2][3]. The vulnerability does not directly allow code execution or privilege escalation.

Mitigation

Microsoft released security bulletin MS15-112 on November 10, 2015, which includes an update (KB 3104517) that fixes this vulnerability by modifying how Internet Explorer handles objects in memory [1]. Users should apply the update immediately. No workarounds are documented.