CVE-2016-3298: Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."
Other sources
An information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.
— CISA
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-3298?
The severity of CVE-2016-3298 is classified as critical due to its potential for information disclosure.
How do I fix CVE-2016-3298?
To fix CVE-2016-3298, users should apply the latest security updates provided by Microsoft.
What versions of Internet Explorer are affected by CVE-2016-3298?
CVE-2016-3298 affects Internet Explorer versions 9, 10, and 11.
What operating systems are impacted by CVE-2016-3298?
CVE-2016-3298 impacts Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, and their respective server editions.
Can CVE-2016-3298 be exploited remotely?
Yes, CVE-2016-3298 can be exploited remotely via a crafted website that allows attackers to determine the existence of arbitrary files.