EXPOSURES › CVE-2015-0071
CVE-2015-0071
HIGH ⌖ ON CISA KEV · EXPLOITEDA crafted website bypassed Internet Explorer's ASLR protection, enabling remote attackers to execute arbitrary code.
This vulnerability allowed remote attackers to bypass ASLR in Internet Explorer, leading to potential remote code execution. DIB organizations must ensure all browsers are patched and consider disabling legacy browsers like IE, as this flaw was actively exploited in the wild and represents a significant compliance risk under NIST 800-171 for unpatched software.
Shame score — Microsoft failed to patch a known ASLR bypass vulnerability that was actively exploited in the wild, demonstrating negligence in maintaining a critical security control.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |