Unscored severity · published Jul 14, 2015
CVE-2015-2372
vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a…
–
CVSS
20.1%
EPSS
No
On KEV
Description
vbscript.dll in Microsoft VBScript 5.6 through 5.8, as used with Internet Explorer 6 through 11 and other products, allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "VBScript Memory Corruption Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)20.1% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VB
Vbscript · Microsoft
5.6; 5.7; 5.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2015-2372
CVE.org
https://www.cve.org/CVERecord?id=CVE-2015-2372
www.securitytracker.com
http://www.securitytracker.com/id/1032894
www.securitytracker.com
http://www.securitytracker.com/id/1032895
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-065
docs.microsoft.com
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-066
More from Vbscript
7.5
CVE-2016-0189
Microsoft Internet Explorer Memory Corruption Vulnerability
8.8
CVE-2011-0663
Multiple integer overflows in the Microsoft (1) JScript 5.6 through 5.8 and (2) VBScript 5.6 through 5.8 scripting engines allow remote attackers to execute arbitrary code via a…
7.5
CVE-2016-3207
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…
7.5
CVE-2016-3206
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…
7.5
CVE-2016-3205
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote attackers to execute arbitrary code…